Mobile app testing without a rooted phone or a PC
Certificate pinning is why mobile capture usually returns nothing: a pinned app trusts only its own baked-in certificate, not the CA you installed. Crossfyre’s Mobile Tracer captures traffic on the Android device itself, and when an app is pinned it runs a server-assisted repackage that needs neither root nor a workstation.
Why does mobile capture stop at pinned apps?
Two layers get in the way. Since Android 7, apps ignore user-installed CAs unless their network security config opts in, so a certificate you added by hand is invisible to most apps. On top of that, a pinned app (dating, banking, anything handling money or identity) ships its own certificate or public-key hash and will only talk to a server presenting that exact key. Your interception proxy is a stranger, the TLS handshake fails, and the capture screen stays empty. Every VpnService-based capture app on the Play Store hits this same wall.
How does on-device capture work with no laptop?
Mobile Tracer is an Android app that registers as a VpnService, so the operating system routes the device’s own traffic through it. Inside the app, a Rust capture crate compiled for Android and driven over JNI terminates TLS with a per-session CA and re-originates the connection to the real server. You choose which apps are in scope, so nothing outside your target is captured. Pairing to a workspace is a QR scan. There is no proxy setting to configure, no computer on the same Wi-Fi, and no USB cable.
How does Crossfyre handle a pinned app?
With a server-assisted repackage that requires neither root nor a PC. The phone uploads the target app’s split APKs along with the session CA. Our patch service rewrites and re-signs the app so it trusts your session certificate instead of only its own, and sends back patched, installable splits that the phone reinstalls. Making that hold up across real-world apps is where the engineering went, and that pipeline stays on our side. One tap, and an app that was previously un-interceptable on an unrooted physical handset starts yielding full request and response bodies.
What do you get once traffic is flowing?
The same surfaces as the rest of the platform, not a separate silo. Captured requests stream into a Requests table with full request and response bodies, filtering, and detail panes. An intercept gate lets you hold a request in flight and modify, forward, or drop it. Anything interesting goes to Bench, the Repeater, which replays it through a distributed node rather than from your browser, so the traffic leaves from egress you control. Endpoints and parameters also land in the shared asset graph alongside everything web recon found, so a mobile backend is just more of the same attack surface.
Is anyone else doing this?
Be clear about what is and is not new. On-device, no-root, no-PC capture is common: PCAPdroid, Reqable, Packet Capture, NetCapture, and HTTP Canary all do VpnService MITM with a user CA, and they all stop at pinned apps. APK repackaging to strip pinning is equally commodity, documented in the OWASP MASTG and by NetSPI, using apk-mitm, objection patchapk, Frida, or Magisk modules like MagiskTrustUserCerts. Every serious interception tool (Burp Suite, ZAP, mitmproxy, Charles, Fiddler, Proxyman, HTTP Toolkit) is a desktop proxy your phone points at. HTTP Toolkit automates unpinning with Frida but needs a rooted device or emulator. Corellium does managed pinning bypass on its own hosted, rooted virtual devices. What we could find no competitor offering is the combination: automated pinning bypass with no root, no workstation, driven from the user’s own physical phone through a cloud repackage-and-reinstall loop, wired into a platform with intercept, a node-backed Repeater, and an asset graph. That is a search coming up empty, not a proof that nothing exists.
Frequently asked
Does this work on iOS?
No. Mobile Tracer is Android only. The VpnService capture path, the split-APK repackage, and the PackageInstaller reinstall are all Android mechanisms with no iOS equivalent, and we are not claiming parity we do not have.
Which apps am I allowed to do this to?
Only apps you own or have written permission to test, and only where repackaging is permitted by the terms you are operating under. Patching and reinstalling someone else’s app on a device you control is a standard authorized-testing technique, but scope and permission come first. Crossfyre is for authorized work.
Do I need to be on a waitlist?
No. Crossfyre is in open beta: you can sign up and use it today. Mobile Tracer is part of that, on Android.