I am trying to intercept the request with burp suite for mobile application pen testing on iOS and Android devices.

Here are the settings below which I have done in below points.

  1. I made sure that my mobile device and the burp is on same network
  2. All interfaces in proxy options
  3. Downloaded ca certificate on the mobile and enabled from Certificate Trust Settings for PortSwigger CA.
  4. Set the manual proxy on device to same IP address which is on PC.
  5. Asked application team if there is any SSL pinning is implemented and the answer was "NO" from their end.

Information on my issues where I got stuck.

When I intercept the request in burp I see so many error messages the client failed to negotiate an SSL connection.

Finally I came to an understanding that I need to have a rooted or jailbreak device to fully test the application and I am not sure how to do those things in the new version of iOS and android (made in USA)

  • Are you just asking how to root your device? That's not really on topic here, regardless of your reasons for doing so. Commented Jan 24, 2019 at 21:09

1 Answer 1


You sound like you're on the right track. Please try accessing http://example.com/ from the mobile browser - this will confirm that proxying works for non-HTTPS sites.

To install the certificate on recent iOS you must "Enable full trust for root certificates". Instructions here

To install the certificate on recent Android you do need a rooted device.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .