0

I am trying to intercept the request with burp suite for mobile application pen testing on iOS and Android devices.

Here are the settings below which I have done in below points.

  1. I made sure that my mobile device and the burp is on same network
  2. All interfaces in proxy options
  3. Downloaded ca certificate on the mobile and enabled from Certificate Trust Settings for PortSwigger CA.
  4. Set the manual proxy on device to same IP address which is on PC.
  5. Asked application team if there is any SSL pinning is implemented and the answer was "NO" from their end.

Information on my issues where I got stuck.

When I intercept the request in burp I see so many error messages the client failed to negotiate an SSL connection.

Finally I came to an understanding that I need to have a rooted or jailbreak device to fully test the application and I am not sure how to do those things in the new version of iOS and android (made in USA)

bumped to the homepage by Community 20 hours ago

This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.

  • Are you just asking how to root your device? That's not really on topic here, regardless of your reasons for doing so. – AndrolGenhald Jan 24 at 21:09
0

You sound like you're on the right track. Please try accessing http://example.com/ from the mobile browser - this will confirm that proxying works for non-HTTPS sites.

To install the certificate on recent iOS you must "Enable full trust for root certificates". Instructions here

To install the certificate on recent Android you do need a rooted device.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.