Configuring Burp to proxy traffic from mobile apps

In this blog post, I'll explore how to configure Burp to proxy traffic from mobile apps to assist with the security testing of mobile applications.

Getting started

To get started, there are a few pre-requisites needed:

1. 

   Windows OS
   

   An up-to-date Windows OS with Android Debug Bridge (adb) installed.

2. 

   Kali VM
   

   An up-to-date Kali VM with Android Debug Bridge (adb) installed (run sudo apt-get install adb)

3. 

   Burp Suite
   

   An up-to-date Burp Suite.

4. 

   Mobile Device
   

   A rooted Android device (in this example I'm using a rooted Nexus 5X running LineageOS).
   
   

Configuring the Burp listener

1. Open up Burp
2. Setup listener
   

   Navigate to Proxy > Proxy settings > Proxy listeners then Add a new proxy listener and bind it to port 8081 across All interfaces

   

Connecting the mobile device

3. Connect mobile device via USB
   

   Connect the Android mobile device (in this example I'm using a rooted Nexus 5X running LineageOS) via a USB data cable.

4. Configure the USB connection
   

   On the device, navigate to Settings > Connected devices > USB and select Transfer files

   

Mirroring the mobile device to desktop

5. Download and install Vysor
   

   You can download Vysor from here.

6. Run Vysor
   

   Open Vysor and select the View Device button with a play icon.

   

   Your Android mobile device should not be mirrored to your computer screen.

Configuring the mobile device proxy

7. Configure the mobile device network
   

   On your Android mobile device, navigate to Settings > Network & Internet > Wi-Fi > and select the access point you wish to connect to. Then select Advanced options and set the Proxy to Manual
   
   If you're already connected to the access point before starting this step, ensure you first select Forget network

8. Configure the mobile device proxy
   

   The proxy settings should be set as follows:

   1. (a) Proxy hostname = The IP address of the device using Burp which you wish to proxy traffic through
   2. (b) Proxy port = The port we set earlier which is 8081

   Example:

   

   1. (c) Now click CONNECT

Exporting the CA Certificate

Now Burp is configured to intercept the Android mobile device traffic, but without a valid CA Certificate in place will be unable to decrypt HTTPS traffic.

9. Export the CA certificate
   

   Open Burp and navigate to Proxy > Proxy settings > Proxy listeners then select the Import / export CA certificate button

10. Select the CA certificate format
    

    Export the CA Certificate in DER format. In this example we will name it cacert.der

    

Converting the CA certificate format

11. Convert the DER file into PEM
    

    Now we need to convert the DER file into PEM format for Android and have the filename equal to the subject_hash_old value appended with a .0. To achieve this, we can move the cacert.der file over to a Kali VM and execute the following commands:

    openssl x509 -inform DER -in cacert.der -out cacert.pem
openssl x509 -inform PEM -subject_hash_old -in cacert.pem | head -1
mv cacert.pem [hash].0

    Example:

    

12. Move the PEM file to the mobile device
    

    Now we need to move the newly created PEM file over to the Android mobile device /system filesystem. To achieve this we can leverage the following adb commands:

    adb root
adb remount
adb push [cert].0 /sdcard/
adb shell
mv /sdcard/[cert].0 /system/etc/security/cacerts/
chmod 644 /system/etc/security/cacerts/[cert].0
exit
adb reboot
    

    Example:

    

Verifying the CA certificate is installed

13. Verify the certificate installation
    

    Once restarted, the CA Certificate should be installed on the Android mobile device. This can be verified by navigating to Settings > Security & privacy > Encryption & credentials > Trusted credentials and searching in the System directory to validate the CA Certificate from PortSwigger is present.

    

Follow Jacob Riggs

Jacob Riggs

Jacob Riggs is a Security Lead based in the UK with almost a decade of experience working to improve the cyber security of media and third sector organisations. His contributions focus on expanding encryption tools, promoting crypto-anarchist philosophy, and pioneering projects centred on leveraging cryptography to protect the privacy and political freedoms of others.

E3FE 4B44 56F5 69BE 76C1 E169 E3C7 0A52 9AEF DB6F