2024-05-13
Prerequisites
- Burp Suite is required.
- Android SDK platform-tools (adb) are required.
Step 1 – Setting up Burp Suite
- In Burp Suite, open the Proxy tab.
- Click Proxy Settings.
- Burp Suite will listen on port 8080 from all interfaces.
- Click import/export CA certificate.
- Click Export.
- Choose Certificate in DER format.
- Choose a path and name the file with a .der extension.
- The file will be named Burp_cert.der for this tutorial.
Step 2 – Upload and install the Burp Suite Certificate
- Start your device.
- Drag and drop the Burp_cert.der file you generated to the device display.
- Go to Android Settings and install a certificate.
- In the results, click Install certificates from SD Card and select CA certificate.
- Click install anyway to bypass the warning.
- Navigate to /sdcard/Download and click Burp_cert.der.
- If you are using Android 9 or below, you may be prompted to set a secure lock screen.
- Comply and set a lock.
- To verify whether the certificate is properly installed, go to Android settings and click Trusted credentials.
- You should see the certificate in the USER tab.
- This method alters the Android system significantly and may break the device.
- Use with extreme care and only if necessary!
Android 14+
- Root the device.
- Android 14 and above images are not rooted by default, so make sure that the device is rooted before going any further. Please refer to Genymotion Device Image on-line documentation for more details.
- Install Magisk.
- Follow the instructions from our FAQ to install Magisk: How to install Magisk on Genymotion?
- Install the certificate as user certificate.
- Follow the instructions from the tab “as user certificate”
- Install the Cert-Fix plugin for Magisk.
- Download Cert-Fixer.zip from Cert-Fixer github repository.
- Upload the file to the device. You can either use adb push Cert-Fixer.zip /sdcard/Download or simply drag’n drop the file to the device display.
- Open Magisk and go to the Plugins section.
- Click “Install from storage” and select Cert-Fixed.zip from the Download folder (/sdcard/Download)
- Wait for the plugin to install. When done, click “Reboot” to reboot the device.
- After a reboot, the Burp Suite CA certificate (“Portswigger CA”) should now be installed as a system certificate.
- The Cert-Fix plugin will copy any user certificate as system certificate on boot.
- If you don’t need to install any other system certificates, make sure to disable the plugin to avoid installing system certificates by mistake.
Android 12-13
- Root the device.
- Android 12-13 images are not rooted by default, so make sure that the device is rooted before going any further. Please refer to Genymotion Device Image on-line documentation for more details.
- Convert the certificate.
- We need to convert the Burp certificate into PEM format. Use openssl to convert DER to PEM, then output the subject_hash_old:
- OpenSSL commands for DER to PEM conversion (see code block below).
- Rename the file with the output hash from the last command. For example, if the hash is 9a5ba575, then rename the file as 9a5ba575.0.
- Install the certificate
- You will need ADB to proceed. Please refer to Genymotion Device on-line documentation for more information.
- We need to make the /system partition writeable and push the certificate to the /system/etc/security/cacerts folder:
- adb root
- adb shell 'mount -o rw,remount /'
- adb push 9a5ba575.0 /system/etc/security/cacerts/
- adb shell chmod 644 /system/etc/security/cacerts/9a5ba575.0
- Reboot the device.
- After the device has rebooted, browsing to Settings -> Security -> Trusted Credentials should show the new “Portswigger CA” as a system trusted CA.
Step 3 – Set Android global proxy to Burp Suite proxy
- Important: If the global proxy is still set after rebooting or stopping the instance, Internet (Wifi) will be unavailable the next time a device is started from this recipe. To avoid this, make sure to unset the global proxy before.
- If you haven’t already done it, connect the instance to ADB.
- Next, use ADB to set port 3333 but you can use any other port as long as it is available:
- adb shell settings put global http_proxy localhost:3333
- Finally, bind Burp proxy to the device proxy configuration with adb reverse:
- adb reverse tcp:3333 tcp:8080
- From there, your instance network should be intercepted by Burp suite.
Disable global proxy
- Before stopping or rebooting the instance, make sure to disable the global proxy or the Internet connection may be unavailable the next time you start it:
- adb shell settings put global http_proxy :0