4

I am a newbie to Android application security. I would like to know how to tunnel the Android app traffic to Burp Proxy. I have already set the proxy in the emulator and that is working fine. But the application is not using the Burp Suite CA and throwing errors and as a result the application traffic is not showing in Burp Suite.

Could anyone suggest me how to achieve this?

  • 1
  • Primarily you can install BurpCA in the Android device and post that you can retry interception of the traffic and even after this you are unable to intercept the traffic then there are good chances that the application has implemented SSL pinning. You have to bypass pinning to capture the traffic. – Shiv Sahni Feb 22 '18 at 18:03
1

I think it depends on the app. If it uses the system wide Cert settings then you can try importing the Burp CA onto the phone/emulator. You can load the http://burp url in the browser of the phone and then download the CA there, but this only works when Burp is already set as a proxy on the phone. More info here:

https://support.portswigger.net/customer/portal/articles/1841102-Mobile%20Set-up_Android%20Device%20-%20Installing%20CA%20Certificate.html

If the app implements some kind of cert validation itself, then you might need to turn that off somehow, or install the server's private key and cert in burp, of course only if you have them.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.