feat(apk-auditor): apk-mitm patching — trust user CAs + disable NSC pinning, re-sign

Adds a "Patch for MITM" action to the APK Auditor: the loaded APK is uploaded to
a new server endpoint, patched the way niklashigi/apk-mitm does, re-signed, and
downloaded back.

- internal/tools/apkmitm: faithful Go reimplementation of apk-mitm's default
  patch — apktool decode → network security config trusting system+user CAs in
  both base-config and debug-overrides (cleartext permitted) → overwrite the
  app's existing config file (dropping its pin-set) or create + reference a new
  one → set manifest debuggable + networkSecurityConfig → apktool build →
  uber-apk-signer re-sign. Same scope as apk-mitm (NSC-based pinning only;
  programmatic pinning still needs Frida). Unit-tested (NSC contents, existing
  vs new config, pin-set removal, manifest edits).
- POST /api/apk/mitm: authed multipart upload (600 MiB cap), temp-file handling,
  503 with guidance when the toolchain is absent, streams the patched APK back.
- APK Auditor UI: "Patch for MITM" button + upload/progress/download (cookie→Bearer).
- README MITM section updated to the new upload→patch→direct-download flow.

Tooling (apktool + uber-apk-signer + JRE) already ships in the Docker image, so
end-to-end patching runs there; the in-browser static analysis is unchanged.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: h0tak88r

README.md

@@ -34,7 +34,7 @@ Results are automatically uploaded to **Cloudflare R2 storage** and linked direc
 |  **JavaScript**      | Extract secrets, API endpoints, auth tokens from JS files                                                                              |
 |  **GitHub Recon**    | Org-level and repo-level scanning for secrets, dependency confusion                                                                    |
 |  **APK Auditor**     | Browser-based Android analysis: DEX decompiler, manifest + cert parsing, tracker detection, MASVS mapping, and regex-driven findings with APX secret patterns. (Based on [apkauditor](https://github.com/thecybersandeep/apkauditor) by @thecybersandeep) |
-|  **MITM Patch**      | Fetch any Android app by Package ID → auto-patch `network_security_config.xml` → re-sign → R2 download link in one click             |
+|  **MITM Patch**      | One-click **Patch for MITM** in the APK Auditor → server runs `apktool` + `uber-apk-signer` to trust user CAs, disable cert pinning, and re-sign → direct download of the patched APK |
 |  **IPA Auditor**     | Browser-based iOS IPA analysis: plist + Mach-O inspection, binary strings extraction, and findings tab powered by 200+ regex signatures plus MASVS-style rules. (Based on [ipaauditor](https://github.com/thecybersandeep/ipaauditor) by @thecybersandeep) |
 |  **ADB Auditor**    | Browser-based ADB security tool: USB device inspection, app enumeration, logcat tailing, file pull, activity launching. (Based on [adbauditor](https://github.com/thecybersandeep/adbauditor) by @thecybersandeep) |
 |  **Misconfigs**      | 100+ service misconfiguration checks                                                                                                   |
@@ -215,23 +215,21 @@ The **APK Auditor** is a fully browser-based static analysis tool available at `
 - Regex presets and bulk pattern scans for secrets/tokens across code and resources
 - OWASP MASVS aligned reporting — one-click export
 
-**Remote Fetch by Package ID (server-side, with MITM patch):**
+**MITM Patch (server-side, `apk-mitm` style):**
 
 ```bash
-# Via the dashboard UI — click "Fetch Package ID" in the APK Auditor page
-# Enter the package ID, optionally enable MITM patch, click Start
+# In the APK Auditor page, load a .apk, then click "Patch for MITM"
 ```
 
-What happens:
-1. Downloads the APK from APKPure (supports `.xapk` / split APKs automatically)
-2. *(Optional)* Patches `network_security_config.xml` to trust user-installed CAs + disables certificate pinning
-3. Re-signs with `uber-apk-signer` and uploads the patched APK to R2
-4. Shows a **download panel** in the Auditor UI with direct R2 links for:
-   -  Original APK
-   -  MITM Patched APK (if requested)
-5. Automatically loads the APK into the browser auditor for analysis
+What happens (runs `apktool` + `uber-apk-signer` on the server):
+1. Decodes the APK with `apktool`
+2. Injects a network security config that trusts user-installed CAs and disables certificate pinning, and sets `android:networkSecurityConfig` + `android:debuggable` on the manifest
+3. Rebuilds and re-signs the APK with a debug key (`uber-apk-signer`)
+4. Streams the patched, re-signed APK straight back as a **direct download** — uninstall the original, install this one on your test device, and you can intercept its HTTPS traffic with Burp/mitmproxy
 
-> **Scan records from APK Auditor are hidden from the main Scans dashboard** — they exist only within the Auditor context.
+> Requires the Docker image (it bundles `apktool` + `uber-apk-signer` + a JRE). The in-browser analysis above still runs entirely in the tab; only the MITM patch uploads the APK to the server.
+
+> **The APK Auditor never creates records in the main Scans dashboard** — it runs in its own context.
 
 ### Mobile Application Analysis (IPA Auditor)
 

internal/api/api.go

@@ -594,6 +594,8 @@ func SetupAPI() *gin.Engine {
 		apiGroup.GET("/nuclei/templates", apiListNucleiTemplates)
 		// Security Lab — JWT HMAC secret brute-force (client-side analyzer calls this)
 		apiGroup.POST("/jwt/brute", apiJWTBrute)
+		// APK Auditor — patch an uploaded APK for MITM (trust user CAs + disable pinning)
+		apiGroup.POST("/apk/mitm", apiAPKMitm)
 		// Report Templates
 		apiGroup.GET("/report-templates", apiListReportTemplates)
 		apiGroup.GET("/report-templates/export", apiExportReportTemplates)

internal/api/apk_mitm.go

@@ -0,0 +1,62 @@
+package api
+
+import (
+	"net/http"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+	"github.com/h0tak88r/AutoAR/internal/tools/apkmitm"
+)
+
+// maxAPKUpload caps the uploaded APK size for the MITM patch endpoint.
+const maxAPKUpload = 600 << 20 // 600 MiB
+
+// apiAPKMitm patches an uploaded APK for HTTPS interception — it makes the app
+// trust user-installed CAs and disables certificate pinning (apk-mitm style),
+// re-signs it with a debug key, and streams the patched APK back as a download.
+// The patching runs apktool + uber-apk-signer server-side and can take a few
+// minutes for large apps.
+func apiAPKMitm(c *gin.Context) {
+	// Fail fast (and clearly) if the server toolchain is missing — e.g. when not
+	// running inside the Docker image that bundles apktool + uber-apk-signer.
+	if err := apkmitm.CheckTools(); err != nil {
+		c.JSON(http.StatusServiceUnavailable, gin.H{"error": "APK MITM tooling unavailable: " + err.Error()})
+		return
+	}
+
+	c.Request.Body = http.MaxBytesReader(c.Writer, c.Request.Body, maxAPKUpload)
+	file, err := c.FormFile("apk")
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "no APK uploaded (expected multipart field 'apk')"})
+		return
+	}
+	if !strings.HasSuffix(strings.ToLower(file.Filename), ".apk") {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "file must be a .apk"})
+		return
+	}
+
+	work, err := os.MkdirTemp("", "apkmitm-*")
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to create work directory"})
+		return
+	}
+	defer os.RemoveAll(work)
+
+	in := filepath.Join(work, "input.apk")
+	if err := c.SaveUploadedFile(file, in); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to save upload: " + err.Error()})
+		return
+	}
+
+	out, err := apkmitm.Patch(in, work)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "patch failed: " + err.Error()})
+		return
+	}
+
+	// Stream the patched APK back (written synchronously before the deferred cleanup).
+	base := strings.TrimSuffix(filepath.Base(file.Filename), filepath.Ext(file.Filename))
+	c.FileAttachment(out, base+"-patched.apk")
+}

internal/api/ui/apkauditor/index.html

@@ -150,6 +150,10 @@ <h2 id="appName">App Name</h2>
                         <button class="export-item" data-export="sarif" role="menuitem" type="button"><span class="export-item-name">SARIF 2.1</span><span class="export-item-desc">GitHub Code Scanning</span></button>
                     </div>
                 </div>
+                <button class="btn btn-ghost" id="mitmPatchBtn" type="button" title="Patch this APK to trust user CAs &amp; disable certificate pinning, then download the re-signed APK">
+                    <svg viewBox="0 0 24 24" width="14" height="14" fill="none" stroke="currentColor" stroke-width="2" aria-hidden="true"><path d="M12 2 4 5v6c0 5 3.5 8 8 11 4.5-3 8-6 8-11V5l-8-3z"/><path d="m9 12 2 2 4-4"/></svg>
+                    <span id="mitmPatchBtnLabel">Patch for MITM</span>
+                </button>
                 <button class="btn btn-primary" id="newScanBtn" type="button">
                     <svg viewBox="0 0 24 24" width="16" height="16" fill="none" stroke="currentColor" stroke-width="2" aria-hidden="true"><polyline points="23 4 23 10 17 10"/><path d="M20.49 15a9 9 0 1 1-2.12-9.36L23 10"/></svg>
                     New Scan

internal/api/ui/apkauditor/src/main.js

@@ -1462,6 +1462,65 @@ function setupPreviewRotator() {
     }, 3600);
 }
 
+// The auditor is served in an iframe/tab where the dashboard sets a JS-readable
+// autoar_token cookie; the /api auth middleware wants it as a Bearer header.
+function getAuthTokenFromCookie() {
+    const m = document.cookie.match(/(?:^|;\s*)autoar_token=([^;]+)/);
+    return m ? decodeURIComponent(m[1]) : '';
+}
+
+// patchApkForMitm uploads the currently-loaded APK to the server, which patches
+// it (trust user CAs + disable cert pinning) and re-signs it, then downloads the
+// patched APK. The patching is server-side (apktool + uber-apk-signer) and can
+// take a few minutes — this is the one action where the APK leaves the tab.
+async function patchApkForMitm() {
+    const btn = $('#mitmPatchBtn');
+    const label = $('#mitmPatchBtnLabel');
+    if (!State.currentFile) {
+        toast('Load an .apk first, then patch it for MITM', 'error');
+        return;
+    }
+    if (!/\.apk$/i.test(State.currentFile.name)) {
+        toast('MITM patching only works on .apk files', 'error');
+        return;
+    }
+    const origLabel = label ? label.textContent : 'Patch for MITM';
+    if (btn) btn.disabled = true;
+    if (label) label.textContent = 'Patching…';
+    toast('Uploading & patching APK — apktool + re-signing runs on the server and can take a few minutes…', 'info');
+    try {
+        const fd = new FormData();
+        fd.append('apk', State.currentFile, State.currentFile.name);
+        const tok = getAuthTokenFromCookie();
+        const resp = await fetch('/api/apk/mitm', {
+            method: 'POST',
+            headers: tok ? { Authorization: 'Bearer ' + tok } : {},
+            body: fd,
+        });
+        if (!resp.ok) {
+            let msg = 'HTTP ' + resp.status;
+            try { const j = await resp.json(); if (j && j.error) msg = j.error; } catch (_) { /* non-JSON */ }
+            throw new Error(msg);
+        }
+        const blob = await resp.blob();
+        const base = State.currentFile.name.replace(/\.apk$/i, '');
+        const url = URL.createObjectURL(blob);
+        const a = document.createElement('a');
+        a.href = url;
+        a.download = base + '-patched.apk';
+        document.body.appendChild(a);
+        a.click();
+        a.remove();
+        setTimeout(() => URL.revokeObjectURL(url), 4000);
+        toast('Patched APK downloaded — uninstall the original, then install this one on your test device.', 'success');
+    } catch (e) {
+        toast('MITM patch failed: ' + e.message, 'error');
+    } finally {
+        if (btn) btn.disabled = false;
+        if (label) label.textContent = origLabel;
+    }
+}
+
 function init() {
     setupGlobalErrors();
     if ('serviceWorker' in navigator) {
@@ -1476,6 +1535,7 @@ function init() {
     setupCursorSpot();
     setupPreviewRotator();
     $('#newScanBtn') && $('#newScanBtn').addEventListener('click', () => $('#fileInput').click());
+    $('#mitmPatchBtn') && $('#mitmPatchBtn').addEventListener('click', patchApkForMitm);
     $('#heroCta') && $('#heroCta').addEventListener('click', () => $('#fileInput').click());
     $('#downloadFileBtn') && $('#downloadFileBtn').addEventListener('click', downloadCurrentFile);
     document.querySelectorAll('a.logo, .logo[href]').forEach(el => {