Merge testing: revert server-side MITM patching, slim Docker image

Author: h0tak88r

Dockerfile

@@ -64,17 +64,9 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     git curl ca-certificates tini jq dnsutils libpcap0.8 \
     postgresql-client docker.io \
     python3 sqlmap nmap \
-    default-jre-headless unzip zip \
+    unzip zip \
     && rm -rf /var/lib/apt/lists/*
 
-# Install Apktool and Uber-APK-Signer for MITM patching
-RUN curl -L https://raw.githubusercontent.com/iBotPeaches/Apktool/master/scripts/linux/apktool -o /usr/local/bin/apktool && \
-    chmod +x /usr/local/bin/apktool && \
-    curl -L https://github.com/iBotPeaches/Apktool/releases/download/v2.10.0/apktool_2.10.0.jar -o /usr/local/bin/apktool.jar && \
-    curl -L https://github.com/patrickfav/uber-apk-signer/releases/download/v1.3.0/uber-apk-signer-1.3.0.jar -o /usr/local/bin/uber-apk-signer.jar && \
-    curl -L https://github.com/EFForg/apkeep/releases/download/0.18.0/apkeep-x86_64-unknown-linux-gnu -o /usr/local/bin/apkeep && \
-    chmod +x /usr/local/bin/apkeep
-
 # Copy minimal application configuration and assets (source not required at runtime)
 COPY regexes/ ./regexes/
 COPY templates/ ./templates/

README.md

@@ -34,7 +34,6 @@ Results are automatically uploaded to **Cloudflare R2 storage** and linked direc
 |  **JavaScript**      | Extract secrets, API endpoints, auth tokens from JS files                                                                              |
 |  **GitHub Recon**    | Org-level and repo-level scanning for secrets, dependency confusion                                                                    |
 |  **APK Auditor**     | Browser-based Android analysis: DEX decompiler, manifest + cert parsing, tracker detection, MASVS mapping, and regex-driven findings with APX secret patterns. (Based on [apkauditor](https://github.com/thecybersandeep/apkauditor) by @thecybersandeep) |
-|  **MITM Patch**      | One-click **Patch for MITM** in the APK Auditor → server runs `apktool` + `uber-apk-signer` to trust user CAs, disable cert pinning, and re-sign → direct download of the patched APK |
 |  **IPA Auditor**     | Browser-based iOS IPA analysis: plist + Mach-O inspection, binary strings extraction, and findings tab powered by 200+ regex signatures plus MASVS-style rules. (Based on [ipaauditor](https://github.com/thecybersandeep/ipaauditor) by @thecybersandeep) |
 |  **ADB Auditor**    | Browser-based ADB security tool: USB device inspection, app enumeration, logcat tailing, file pull, activity launching. (Based on [adbauditor](https://github.com/thecybersandeep/adbauditor) by @thecybersandeep) |
 |  **Misconfigs**      | 100+ service misconfiguration checks                                                                                                   |
@@ -43,7 +42,7 @@ Results are automatically uploaded to **Cloudflare R2 storage** and linked direc
 |  **AI Agent**        | Full AI hunt loop from the CLI (`autoar agent` / `autoar explain`) — defaults to **deepseek-v4-flash-free via OpenCode Zen** — free tier, no card required |
 |  **R2 Storage**      | Auto-upload every non-empty result file to Cloudflare R2 and print the public URL                                                      |
 |  **Smart Alerts**    | Rich webhook notifications for zero-findings scans — no more empty files or spam                                                       |
-|  **Web dashboard**  | **v4.1+** — Stats, scans, domains, monitors, R2 browser, Targets, APK/IPA/ADB Auditors, MITM remote scan, CF-1016 findings. Unified findings table with per-module columns, inline expandable detail panels, severity/chip/multi-field filters            |
+|  **Web dashboard**  | **v4.1+** — Stats, scans, domains, monitors, R2 browser, Targets, APK/IPA/ADB Auditors, CF-1016 findings. Unified findings table with per-module columns, inline expandable detail panels, severity/chip/multi-field filters            |
 
 
 ---
@@ -215,19 +214,7 @@ The **APK Auditor** is a fully browser-based static analysis tool available at `
 - Regex presets and bulk pattern scans for secrets/tokens across code and resources
 - OWASP MASVS aligned reporting — one-click export
 
-**MITM Patch (server-side, `apk-mitm` style):**
-
-```bash
-# In the APK Auditor page, load a .apk, then click "Patch for MITM"
-```
-
-What happens (runs `apktool` + `uber-apk-signer` on the server):
-1. Decodes the APK with `apktool`
-2. Injects a network security config that trusts user-installed CAs and disables certificate pinning, and sets `android:networkSecurityConfig` + `android:debuggable` on the manifest
-3. Rebuilds and re-signs the APK with a debug key (`uber-apk-signer`)
-4. Streams the patched, re-signed APK straight back as a **direct download** — uninstall the original, install this one on your test device, and you can intercept its HTTPS traffic with Burp/mitmproxy
-
-> Requires the Docker image (it bundles `apktool` + `uber-apk-signer` + a JRE). The in-browser analysis above still runs entirely in the tab; only the MITM patch uploads the APK to the server.
+> **Want to MITM an app's HTTPS traffic?** The auditor is static-analysis only — kept deliberately lightweight (all in-browser, no heavy server-side Java toolchain). To prepare an APK for interception, patch it locally with [apk-mitm](https://github.com/niklashigi/apk-mitm) (`npx apk-mitm app.apk`), install the patched build on your test device, then drop it back into the auditor if you want to analyze it.
 
 > **The APK Auditor never creates records in the main Scans dashboard** — it runs in its own context.
 

internal/api/api.go

@@ -594,8 +594,6 @@ func SetupAPI() *gin.Engine {
 		apiGroup.GET("/nuclei/templates", apiListNucleiTemplates)
 		// Security Lab — JWT HMAC secret brute-force (client-side analyzer calls this)
 		apiGroup.POST("/jwt/brute", apiJWTBrute)
-		// APK Auditor — patch an uploaded APK for MITM (trust user CAs + disable pinning)
-		apiGroup.POST("/apk/mitm", apiAPKMitm)
 		// Report Templates
 		apiGroup.GET("/report-templates", apiListReportTemplates)
 		apiGroup.GET("/report-templates/export", apiExportReportTemplates)

internal/api/apk_mitm.go

@@ -150,10 +150,6 @@ <h2 id="appName">App Name</h2>
                         <button class="export-item" data-export="sarif" role="menuitem" type="button"><span class="export-item-name">SARIF 2.1</span><span class="export-item-desc">GitHub Code Scanning</span></button>
                     </div>
                 </div>
-                <button class="btn btn-ghost" id="mitmPatchBtn" type="button" title="Patch this APK to trust user CAs &amp; disable certificate pinning, then download the re-signed APK">
-                    <svg viewBox="0 0 24 24" width="14" height="14" fill="none" stroke="currentColor" stroke-width="2" aria-hidden="true"><path d="M12 2 4 5v6c0 5 3.5 8 8 11 4.5-3 8-6 8-11V5l-8-3z"/><path d="m9 12 2 2 4-4"/></svg>
-                    <span id="mitmPatchBtnLabel">Patch for MITM</span>
-                </button>
                 <button class="btn btn-primary" id="newScanBtn" type="button">
                     <svg viewBox="0 0 24 24" width="16" height="16" fill="none" stroke="currentColor" stroke-width="2" aria-hidden="true"><polyline points="23 4 23 10 17 10"/><path d="M20.49 15a9 9 0 1 1-2.12-9.36L23 10"/></svg>
                     New Scan

internal/api/ui/apkauditor/index.html

@@ -1462,65 +1462,6 @@ function setupPreviewRotator() {
     }, 3600);
 }
 
-// The auditor is served in an iframe/tab where the dashboard sets a JS-readable
-// autoar_token cookie; the /api auth middleware wants it as a Bearer header.
-function getAuthTokenFromCookie() {
-    const m = document.cookie.match(/(?:^|;\s*)autoar_token=([^;]+)/);
-    return m ? decodeURIComponent(m[1]) : '';
-}
-
-// patchApkForMitm uploads the currently-loaded APK to the server, which patches
-// it (trust user CAs + disable cert pinning) and re-signs it, then downloads the
-// patched APK. The patching is server-side (apktool + uber-apk-signer) and can
-// take a few minutes — this is the one action where the APK leaves the tab.
-async function patchApkForMitm() {
-    const btn = $('#mitmPatchBtn');
-    const label = $('#mitmPatchBtnLabel');
-    if (!State.currentFile) {
-        toast('Load an .apk first, then patch it for MITM', 'error');
-        return;
-    }
-    if (!/\.apk$/i.test(State.currentFile.name)) {
-        toast('MITM patching only works on .apk files', 'error');
-        return;
-    }
-    const origLabel = label ? label.textContent : 'Patch for MITM';
-    if (btn) btn.disabled = true;
-    if (label) label.textContent = 'Patching…';
-    toast('Uploading & patching APK — apktool + re-signing runs on the server and can take a few minutes…', 'info');
-    try {
-        const fd = new FormData();
-        fd.append('apk', State.currentFile, State.currentFile.name);
-        const tok = getAuthTokenFromCookie();
-        const resp = await fetch('/api/apk/mitm', {
-            method: 'POST',
-            headers: tok ? { Authorization: 'Bearer ' + tok } : {},
-            body: fd,
-        });
-        if (!resp.ok) {
-            let msg = 'HTTP ' + resp.status;
-            try { const j = await resp.json(); if (j && j.error) msg = j.error; } catch (_) { /* non-JSON */ }
-            throw new Error(msg);
-        }
-        const blob = await resp.blob();
-        const base = State.currentFile.name.replace(/\.apk$/i, '');
-        const url = URL.createObjectURL(blob);
-        const a = document.createElement('a');
-        a.href = url;
-        a.download = base + '-patched.apk';
-        document.body.appendChild(a);
-        a.click();
-        a.remove();
-        setTimeout(() => URL.revokeObjectURL(url), 4000);
-        toast('Patched APK downloaded — uninstall the original, then install this one on your test device.', 'success');
-    } catch (e) {
-        toast('MITM patch failed: ' + e.message, 'error');
-    } finally {
-        if (btn) btn.disabled = false;
-        if (label) label.textContent = origLabel;
-    }
-}
-
 function init() {
     setupGlobalErrors();
     if ('serviceWorker' in navigator) {
@@ -1535,7 +1476,6 @@ function init() {
     setupCursorSpot();
     setupPreviewRotator();
     $('#newScanBtn') && $('#newScanBtn').addEventListener('click', () => $('#fileInput').click());
-    $('#mitmPatchBtn') && $('#mitmPatchBtn').addEventListener('click', patchApkForMitm);
     $('#heroCta') && $('#heroCta').addEventListener('click', () => $('#fileInput').click());
     $('#downloadFileBtn') && $('#downloadFileBtn').addEventListener('click', downloadCurrentFile);
     document.querySelectorAll('a.logo, .logo[href]').forEach(el => {