Prerequisites
- Burp suite
- Android SDK platform-tools (adb)
Step 1 – Setting up Burp Suite
- In Burp Suite, go to the Proxy tab.
- Click Proxy Settings.
- Choose to listen to port 8080 from all interfaces.
- Click import/export CA certificate.
- Export the certificate in DER format.
- Choose a path and name it Burp_cert.der.
- We will use the name Burp_cert.der as an example for this tutorial.
Step 2 – Upload and install the Burp Suite Certificate
- Start your device.
- Drag’n drop the Burp_cert.der file you generated to the device display.
- Go to Android Settings and install a certificate.
- In the results, click Install certificates from SD Card and select CA certificate.
- Click install anyway to bypass the warning.
- Navigate to /sdcard/Download and click on Burp_cert.der.
- If you are using Android 9 or below, you may be requested to set a secure lock screen. Comply and set a lock.
- To verify whether the certificate is properly installed, go to Android settings, and click Trusted credentials.
- You should see the certificate in the USER tab.
- This method alters the Android system significantly and may break the device.
- Use with extreme care and only if necessary!
Android 14+
- Installing System certificates on Android 14+ requires Magisk and a third party plugin.
- Root the device: Android 14 and above images are not rooted by default, so make sure that the device is rooted before going any further.
- Refer to Genymotion Device Image on-line documentation for more details.
- Install Magisk: Follow the instructions from our FAQ to install Magisk.
- Install the certificate as user certificate: Follow the instructions from the tab “as user certificate”.
- Install the Cert-Fix plugin for Magisk: Download Cert-Fixer.zip from Cert-Fixer GitHub repository.
- Upload the file to the device. You can either use adb push Cert-Fixer.zip /sdcard/Download or simply drag’n drop the file to the device display.
- Open Magisk and go to the Plugins section.
- Click “Install from storage” and select Cert-Fixed.zip from the Download folder (/sdcard/Download).
- Wait for the plugin to install. When done, click “Reboot” to reboot the device.
- After a reboot, the Burp Suite CA certificate (“PortSwigger CA”) should now be installed as a system certificate.
- The Cert-Fix plugin will copy any user certificate as system certificate on boot. If you don’t need to install any other system certificates, make sure to disable the plugin to avoid installing system certificates by mistake.
Android 12-13
- Root the device: Android 12-13 images are not rooted by default, so make sure that the device is rooted before going any further.
Step 2 (continued) – Convert the certificate
- Convert the Burp certificate into PEM format using openssl.
- openssl x509 -inform DER -in Burp_cert.der -out Burp_cert.pem
- Display the subject_hash_old:
- openssl x509 -inform PEM -subject_hash_old -in Burp_cert.pem |head -1
- Rename the file with the output hash from the last command.
- mv Burp_cert.pem 9a5ba575.0
- The example uses 9a5ba575.0 as the filename.
Step 3 – Install the certificate
- You will need ADB to proceed.
- Make the /system partition writable and push the certificate to the
/system/etc/security/cacerts folder.
- adb root
- adb shell 'mount -o rw,remount /'
- adb push 9a5ba575.0 /system/etc/security/cacerts/
- adb shell chmod 644 /system/etc/security/cacerts/9a5ba575.0
- Reboot the device.
- After reboot, Settings -> Security -> Trusted Credentials should show Portswigger CA as a system trusted CA.
- If you prefer alternative command sequences, see the repeated blocks with similar steps for certificate installation and permissions.
Step 3 – Set Android global proxy to Burp Suite proxy
- Important: If the global proxy is still set after rebooting or stopping the instance, Internet (Wifi) will be unavailable the next time a device is started from this recipe. To avoid this, unset the global proxy before.
- If you haven’t already done it, connect the instance to ADB.
- Use ADB to set port 3333 (any available port may be used):
- adb shell settings put global http_proxy localhost:3333
- Bind Burp proxy to the device proxy configuration with adb reverse:
- adb reverse tcp:3333 tcp:8080
- From there, your instance network should be intercepted by Burp suite.
Disable global proxy
- Before stopping or rebooting the instance, disable the global proxy to avoid Internet unavailability.
- adb shell settings put global http_proxy :0