Intercept a pinned mobile app from an unrooted phone

The Crossfyre Tracer is an Android app that turns a phone into a capture node. No laptop, no proxy settings, no USB cable. It is live now in the open beta, and the part worth writing about is not the capture: it is what happens when the app you care about is certificate-pinned.

The easy part: capture on the device itself

Mobile Tracer registers as a VpnService, so Android routes the device's own traffic through it. Inside the app, the same Rust capture crate that powers the desktop Web Tracer (compiled for Android and driven over JNI) terminates TLS with a per-session CA and re-originates the connection to the real server. Capture is scoped to the apps you choose, so nothing outside your target is recorded. Pairing to a workspace is a QR scan.

We want to be plain about this: none of that is a differentiator. On-device, no-root, no-PC capture is well-trodden ground. PCAPdroid, Reqable, HTTP Canary, Packet Capture, and NetCapture all do VpnService MITM with a user-installed CA, several of them very well, and some of them for free. If your target is an app that does ordinary TLS validation, any of those tools will show you traffic today.

They also all hit the same wall, and so would we if we stopped here.

The wall: Android 7 plus certificate pinning

Two separate layers get in the way, and they are often conflated.

• User CAs are not trusted by default. Since Android 7, an app only trusts the user certificate store if its network security config opts in. A CA you installed by hand is invisible to most apps, no matter how correctly you installed it.
• Pinning is stricter still. A pinned app ships its own certificate or public-key hash and will only complete a handshake with a server presenting that exact key. Even a CA in the system store does not help. Your interception layer is a stranger, the handshake fails, and the capture screen stays empty.

Anything that handles money or identity tends to pin: banking, dating, ride-hailing, health. Which is to say the apps most worth testing are exactly the ones plain on-device capture cannot see. That is the actual problem.

What everyone else does about it

The canonical answers are well documented, in the OWASP MASTG and in write-ups from teams like NetSPI, and they come down to two families:

1. Own the runtime. Root the device or use an emulator, then hook the app at runtime with Frida, or force user-CA trust with a Magisk module. Reliable, general, and it requires a device you have rooted.
2. Rewrite the app. Decompile, patch out the pinning, inject a network security config that trusts the user store, rebuild and re-sign. Tools like apk-mitm and objection patchapk automate most of this, driven from a workstation.

Both work. Both are per-app, manual, and anchored to a computer. Meanwhile every serious interception tool in the category (Burp Suite, ZAP, mitmproxy, Charles, Fiddler, Proxyman, HTTP Toolkit) is a desktop proxy: the phone is configured to route through a machine on the network. HTTP Toolkit goes further than most and automates unpinning with Frida, which is genuinely good engineering, but that path needs a rooted device or an emulator. Corellium gives you managed pinning bypass with no fuss at all, on its own hosted, virtual, rooted devices, which is a different thing from your physical handset.

None of these are bad tools. They are good tools that assume a workstation, a rooted device, or both.

Our answer: a server-assisted repackage, from the phone

Crossfyre moves the repackage off the workstation and into the platform, and drives the whole loop from the phone. When Mobile Tracer sees that a scoped app is pinned, patching it is one tap. What happens underneath:

1. The phone reads the target app's own split APKs and uploads them, along with the session CA, to the patch service.
2. The service rewrites and re-signs the app. It patches out the common pinning implementations so the app trusts your session certificate instead of only its own. Getting that to hold up across real-world split and bundle layouts is where the engineering went, and that part stays on our side.
3. Patched, installable splits come back and the phone reinstalls them through PackageInstaller. Because the signature changed, this is an uninstall-then-install, not an update in place.

After that, the app is a normal app that happens to trust your session CA, and the capture you already had running starts producing full request and response bodies from a target that was previously un-interceptable on an unrooted physical phone.

The claim, stated carefully

We are not claiming to have invented anything here. APK repackaging to strip pinning is fully commodity: the technique is in the OWASP MASTG, the tooling is open source, and plenty of testers have been doing it by hand for years. Every individual piece of this is prior art.

What we could not find any competitor offering is the combination: automated pinning bypass with no root, no PC, driven from the user's own physical phone through a cloud repackage-and-reinstall loop, wired into a hosted platform. That is a search that came up empty, not proof that nothing like it exists. If you know of one, we would genuinely like to hear about it.

Two other limits worth stating up front. This is Android only: the VpnService capture path, the split-APK repackage, and the PackageInstaller reinstall are all Android mechanisms, and we are not claiming iOS parity we do not have. And pinning implementations vary, so the pipeline strips the common ones rather than promising every app on the store.

Where the traffic lands

Capture is only useful if it goes somewhere. Mobile traffic lands in the same surfaces as everything else in the platform, not a separate silo:

• A Requests table. Burp-like: every request and response with full bodies, filtering, and detail panes.
• An intercept gate. Hold a request in flight, then modify it, forward it, or drop it.
• Bench, the Repeater. Replay a request as many times as you like with edits, except it runs through a distributed node rather than out of your browser, so the traffic leaves from egress you control.
• The shared asset graph. Endpoints and parameters discovered from the mobile app sit alongside everything web recon found, so the scanners, authenticated scanning, and authorization testing treat a mobile backend as just more attack surface.

That last point is the reason we built this into the platform rather than shipping a standalone capture app. A mobile app is usually the most honest map of an API that exists: it talks to endpoints no web client touches, with parameters no documentation mentions. Getting that into the same graph the scanners read is worth more than the capture itself.

How to try it

Crossfyre is in open beta. This is usable today: there is no waitlist and this is not a "coming soon" post. Install the Tracer on an Android device, scan the QR code to pair it to a workspace, scope it to an app you are authorized to test, and if that app is pinned, tap patch.

The full capability page is mobile app testing without a rooted phone or a PC. For head-to-head context, see Crossfyre vs HTTP Toolkit, vs Corellium, and vs PCAPdroid. Plans are on the pricing page.