Android Application penetration testing

Question

Have problem intercepting HTTPS requests of android application.certificates in android are kept under /system/etc/security/cacerts/ which is different from its previos version of os in cacerts.bks format.Also tried to add certificates from device but it did not work.Any help to intercept the proxy.Android vesion ICS 4.0.

Answer 1

You can do this with BURP which will create a fake SSL certificate that the application will probably accept. If the application is using certificate pinning, then it becomes more difficult, you'll have to patch the application in quesiton.