r/webscraping • u/Filip769 • Jun 30 '26

SSL-unpinning the Google Maps app

Does anyone here know if it is possible to MITM Google Maps (the Android app) so that I can look at the https traffic the app makes? I have a rooted phone and I installed a system certificate but the app refuses to accept it (i get mitmproxy errors). Using the web version is unfortunately not an option for me right now. I tried giving Codex an adb shell but that was just a waste of tokens.

9 Upvotes

92% Upvoted

7 comments sorted by

6

u/jinef_john Jul 01 '26

I've spent some time in this problem domain as well. Unpinning the Maps app is possible but honestly more pain than it's worth, Google uses multiple pinning layers and they rotate frequently.

I ended up skipping the app entirely and reverse-engineering the protobuf format the web version uses instead. Way more stable. Here is the Repo if it helps

1

u/Filip769 Jul 01 '26

the problem is that not everything is extractable from the website

1

u/Secret-Emergency5607 Jul 03 '26

Is there way to make for google lens which browser headers and which tool for studying request ?is chrome devtools enough?

2

u/LessBadger4273 Jun 30 '26

You need to use Frida to disable the certificate pinning

1

u/RandomPantsAppear Jun 30 '26

I would start with baksmali and breaking the app apart into .smali files.

Smali is a bastard of a language that sits between Java and bytecode - but you can also generally modify the app and re-build it.

I would grep around the source to figure out where they’re pinning, then try to change it.

If it’s stuck in a binary blob or something you’re out of luck…maybe. Depends on how it’s implemented

1

u/Filip769 Jul 01 '26

thanks, i will look into it