{"id":19738301,"url":"https://github.com/httptoolkit/android-ssl-pinning-demo","last_synced_at":"2025-10-06T16:32:21.120Z","repository":{"id":44427419,"uuid":"381316319","full_name":"httptoolkit/android-ssl-pinning-demo","owner":"httptoolkit","description":"A tiny demo Android app using SSL pinning to block HTTPS MitM interception","archived":false,"fork":false,"pushed_at":"2024-04-09T12:31:59.000Z","size":386,"stargazers_count":137,"open_issues_count":0,"forks_count":31,"subscribers_count":7,"default_branch":"main","last_synced_at":"2025-01-15T04:48:50.657Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Kotlin","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/httptoolkit.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null}},"created_at":"2021-06-29T09:53:14.000Z","updated_at":"2025-01-12T09:59:28.000Z","dependencies_parsed_at":"2023-10-18T17:30:26.879Z","dependency_job_id":"e4e00153-4ad2-4e93-a2d1-7cafb02b04af","html_url":"https://github.com/httptoolkit/android-ssl-pinning-demo","commit_stats":null,"previous_names":[],"tags_count":8,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/httptoolkit%2Fandroid-ssl-pinning-demo","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/httptoolkit%2Fandroid-ssl-pinning-demo/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/httptoolkit%2Fandroid-ssl-pinning-demo/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/httptoolkit%2Fandroid-ssl-pinning-demo/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/httptoolkit","download_url":"https://codeload.github.com/httptoolkit/android-ssl-pinning-demo/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":235534402,"owners_count":19005491,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-12T01:13:50.841Z","updated_at":"2025-10-06T16:32:15.778Z","avatar_url":"https://github.com/httptoolkit.png","language":"Kotlin","funding_links":[],"categories":[],"sub_categories":[],"readme":"# android-ssl-pinning-demo\n\n\u003e _Part of [HTTP Toolkit](https://httptoolkit.com/): powerful tools for building, testing \u0026 debugging HTTP(S)_\n\nA tiny demo app using SSL pinning to block HTTPS MitM interception.\n\n## Try it out\n\nYou can either clone this repo and build it yourself in Android Studio, or download the APK from the [releases page](https://github.com/httptoolkit/android-ssl-pinning-demo/releases) and install it with `adb install android-ssl-pinning-demo.apk`.\n\nPressing each button will send an HTTP request with the corresponding configuration. The buttons are purple initially or while a request is in flight, and then turn green or red (with corresponding icons and an error message popped up for failures) when the request succeeds/fails.\n\nOn a normal unintercepted device, every button should always immediately pass.\n\nOn a device whose HTTPS is being intercepted (e.g. with [HTTP Toolkit](https://httptoolkit.com/android/)), the unpinned buttons will pass, and then all other buttons the first 'unpinned' buttons will fail.\n\nOn an intercepted device using a standard Frida script (or similar) to automatically disable certificate pinning (e.g. https://github.com/httptoolkit/frida-interception-and-unpinning/) all buttons should pass _except_ the final \"custom-pinned\" button.\n\nThat final button uses low-level manual checks against the TLS connection, with no external libraries or config involved. It is still possible to make this pass too, but you'll need to do a little reverse engineering to disable that code specifically. See [this Android reverse engineering blog post](https://httptoolkit.com/blog/android-reverse-engineering/) for more details.\n\n\u003cimg width=200 src=\"https://raw.githubusercontent.com/httptoolkit/android-ssl-pinning-demo/main/screenshot.png\" alt=\"A screenshot of the app in action\" /\u003e","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fhttptoolkit%2Fandroid-ssl-pinning-demo","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fhttptoolkit%2Fandroid-ssl-pinning-demo","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fhttptoolkit%2Fandroid-ssl-pinning-demo/lists"}