The certificate we exported from Burp is in DER format, so we need to convert it to PEM using openssl and make sure that it has the correct filename: On Android, the system certificates are stored in PEM format in the folder /system/etc/security/cacerts/ with the filename.
BURP SETUP INSTALL
If you’re working with Android 6 or lower you can skip this section, but on newer Android versions we will have to install the proxy’s certificate as a system certificate. Converting the certificate to the correct format Create a proxy listener and export the certificate. While on the options page also add a proxy listener bound to your computer’s ip address and a suitable port and remember this for later. Install Burp and find your way to Proxy → Options and click on the Import / export CA certificate button and export the Certificate in DER format to a convenient place. It’s a very powerful and popular choice even though I haven’t learned to like it yet.
If you manage to get Fiddler working well with the Android Studio emulator, please let me know.ĭue to this I have to settle with Burp Suite Community Edition instead. With physical phones it works fine, but when using an emulator it breaks down. While it works great most of the time, I haven’t been able to get it to work when I install it’s certificate as a system certificate on an emulator. My proxy of choice is Fiddler (classic), it’s pretty nice looking and easy to use for both observing and modifying traffic. We’ll get started by installing and preparing the proxy server we want to use. Proxy and certificate setup Installing the proxy When this is done the proxy decrypts the incoming request and can do whatever it wants with it, before it sets up a new https connection with the remote server, pretending to be the app and thus acting as a man in the middle (MITM). If you can get the phone to trust the proxy’s certificate, for example by installing it as a trusted certificate, the phone will happily accept it when it is presented by the proxy. However, since the proxy’s certificate is not trusted by the phone the phone will not accept this.
To be able to intercept the https traffic the proxy could pretend to be the remote server and present it’s own certificate to the phone when it is trying to connect to the remote server. By doing this you can easily see all http traffic, but since https traffic is encrypted the proxy is not able to read the data. If you want to intercept traffic going in and out from a phone you can set up an http/https proxy server, make sure your phone uses it and then monitor all traffic going trough the proxy. In this post I’m going to describe how you can do this with Burp Suite and the Android Studio Emulator running any Android version from 4 until 11 which is the latest version at the time of writing. Being able to intercept, inspect and modify https traffic between an app and a server can be very useful.
0 kommentar(er)
