I am trying to intercept the request with burp suite for mobile application pen testing on iOS and Android devices.
Here are the settings below which I have done in below points.
- I made sure that my mobile device and the burp is on same network
- All interfaces in proxy options
- Downloaded ca certificate on the mobile and enabled from Certificate Trust Settings for PortSwigger CA.
- Set the manual proxy on device to same IP address which is on PC.
- Asked application team if there is any SSL pinning is implemented and the answer was "NO" from their end.
Information on my issues where I got stuck.
When I intercept the request in burp I see so many error messages the client failed to negotiate an SSL connection.
Finally I came to an understanding that I need to have a rooted or jailbreak device to fully test the application and I am not sure how to do those things in the new version of iOS and android (made in USA)