0

I am trying to intercept the request with burp suite for mobile application pen testing on iOS and Android devices.

Here are the settings below which I have done in below points.

  1. I made sure that my mobile device and the burp is on same network
  2. All interfaces in proxy options
  3. Downloaded ca certificate on the mobile and enabled from Certificate Trust Settings for PortSwigger CA.
  4. Set the manual proxy on device to same IP address which is on PC.
  5. Asked application team if there is any SSL pinning is implemented and the answer was "NO" from their end.

Information on my issues where I got stuck.

When I intercept the request in burp I see so many error messages the client failed to negotiate an SSL connection.

Finally I came to an understanding that I need to have a rooted or jailbreak device to fully test the application and I am not sure how to do those things in the new version of iOS and android (made in USA)

Improve this question
1
  • Are you just asking how to root your device? That's not really on topic here, regardless of your reasons for doing so.
    – AndrolGenhald
    Commented Jan 24, 2019 at 21:09

1 Answer 1

Reset to default
1

You sound like you're on the right track. Please try accessing http://example.com/ from the mobile browser - this will confirm that proxying works for non-HTTPS sites.

To install the certificate on recent iOS you must "Enable full trust for root certificates". Instructions here

To install the certificate on recent Android you do need a rooted device.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .