How to Proxy Android Apps with Burp Suite | Hacking Android Apps

Ever been stuck trying to set up your proxy to capture traffic from your androids browser and apps?
This tutorial will demonstrate how to set this up from start to finish, ensuring that you can easily get your proxies up and running and start capturing traffic.
===== About JSON : Sec =====
JSON Sec is a Cyber Security Awareness KZbin channel, bringing you a range of videos from technical tutorials, security tips and documentaries of previous incidents. The goal is to help everybody through all technical levels to improve the security of their digital life.
Please consider subscribing if you enjoyed this video!
Produced by: Jason Ford
Tools used:
A ROOTED Android device.
Burp Suite - portswigger.net/burp
Root Certificate Manager(ROOT) - play.google.com/store/apps/de...

[@drygordspellweaver8761]

Thanks, you were the first and only person who said to use the ipv4 instead of default gateway..

[@Ryan_Garvey]

How do you not have more views?! Subscribed here!

[@JSONSEC]

Thanks! Share with your friends ☺️

[@zynproduction7824]

Hey buddy...I tried with android 10 smart phone. But not worked for me. I tried without certificate. But not showing any error messages in device. Any help...

[@shubhpanda9569]

@@zynproduction7824 bro certificate is nessasary for doing so

[@creativeguyty]

For real

[@TienTran-im5gs]

Working with TripView Lite app on my device but not working the rest of apps. What am I wrong here when setup?

[@extratechnologys]

I don't have cacert(3).der file. I can't install the certificate. The file is not selected. I found the right menu, but everything is gray

[@predatorBr]

man I love you I really do I put a ring on you! I ve been trying the old method all day long !!!! This was the only thing worked!!! I luv u

[@JSONSEC]

Glad you found it helpful 😊

[@anthonymantillahidalgo6285]

When I put the ipv4 of my pc on my android, the wifi always goes out, I don't have access to the network, why is that?

[@aymenameri6379]

the wifi network not an option for me can i use usb cable . and thanks

[@LaluZulfakarHidayat1998]

How to intercept using hotspot from android? Andnhow to setting the proxy?

[@sud4ksecurity667]

new sub!

[@antonchekhov1456]

Great tutorial !!! Just got traffic from apps but from web failed.

[@JSONSEC]

Web can be a bit fiddley from experience. Make sure you import the CA Certificate to the User Certificate store and ensure you have a lock screen. Let me know how you go!

[@cr7skillzz876]

@@JSONSEC I tried to configure my android 9 phone with burp pro, but when I added proxy ip manually from wifi settings, I lost my wifi connection on my phone (host set to 8081), so I can't download certificate from chrome browser because of lost connection

[@kevinday4874]

@@cr7skillzz876 I have the same issue. Burp can intercept the traffic but no Internet connection.

[@mohammedal-shaboti7939]

Nice, root certificate hmmm. I will try that.

[@alexandermoev9395]

thank you so much it worked!!!!!

[@DayanandhanSubramani]

You earned my sub :)

[@jewel7416]

this method worked?

[@nejmeddinejaafar]

@@jewel7416 yes it did

[@bars5537]

Thank you so much man

[@aMODiEswede]

Thanks for the amazing video, I just have one question which is regarding to rooting the android, is it possible to follow your method without rooting the android phone because if I root the device and test the application that I am targeting it will remove the security layer and it wont authenticate me backend.

[@JSONSEC]

You can't install the root certificate unfortunately. If you don't want to root your primary device, you could try Android emulation in windows, I've got a video on that

[@kundangautam6528]

Where is this video sir ?

[@greg2fs]

@@JSONSEC I just did it on a unrooted phone...

[@angelamcgarvey1753]

The Save button won't enable for me on the phone after I add my IPaddress as Proxy host name and set Proxy to Manual. I also have the Proxy Port filled in (well it was already filled by defalut). Any suggestions? Is there something else I need to fill in?

[@linnahuot]

check u may put space in any area

[@AamirKhan-mx4uc]

Thanks a lot man

[@Thunder-dp7du]

Can you do it on xamarin app?

[@bibnk.1506]

why when I import the certificate Root Certificate Manager (ROOT) it freezes? And only my browser is connected to the internet

[@JSONSEC]

Cert needs to be installed correctly for traffic to pass through As for crash, could be a million things. Try basic trouble shooting like a different version of the Root Cert Manager (Or similar app), try updating / downgrading your Android version too if possible

[@xerohehe]

My proxy is connected but it is not showing any script running when i turn the intercept on😭 while on my previous Android, everything worked fine, is it some android version issue? Android 12 Device poco x3 pro

[@JSONSEC]

I dont think Android version should affect it, I think it's likely a root CA thing

[@OGStapler]

Thanks !

[@javaboy6581]

Thanks! But how to sniff an android apk that send tcp data? Burpsuite not take data and Wireshark take data bur encrypted

[@JSONSEC]

Burp is a HTTP(S) proxy. To be a bit nit picky, HTTP is a TCP protocol. So when it comes to intercepting traffic from android APKs you'll need to find what specific protocol it's communicating with. As you mentioned Wireshark will let you see the traffic, but without certificates it'll be useless.

[@user-vk5xj6xz1x]

Working Super!

[@douglasdarville969]

Is there anyway to do this without a pc? Something like http catcher for iPhone? I don't get why I can't find an android alternative

[@JSONSEC]

Should work fine, so long as the device can operate as a proxy

[@nyaanity]

it's downloading a .der file for me (certificate), which my device can't open. what device model should i use?

[@itsmmdoha]

Rename with .cer

[@mohammedal-shaboti7939]

No, doesn't work for all apps, although I install burp certificate as root, still getting "the client failed to negotiate a TLS connection" error. Browsing https works fine, but apps not all of them accept this certificate.

[@JSONSEC]

Hey Mo, some apps that use SSL Pinning actually bake the certificate into the APK and ONLY trust that certificate in which case this technique wont work (as I mentioned in the video) But this is quite unlikely. Stay tuned for a video once I find out how to bypass SSL Pinning!

[@bimsara12]

@@JSONSEC me too same happening. waiting for a video for bypass SSL Pinning

[@simioni1987]

@@JSONSEC This is just wrong. Only system certificates are trusted per default. You just install a user certificate; not a system certificate. You can see that the Burp CA is even not trusted by your browser (just take a look at the SSL symbol in your video).

[@TheVaaman]

Hey, Did you get a solution for this error?

[@GreyHatz]

After configure proxy I'm getting error without Internet connection

[@shubhpanda9569]

Sir can't we do it without root cause my POCO X2 phone ROM gets corrupted 2 times using root idk why

[@JSONSEC]

I wish!

[@1985junior1]

Top irmão isso q procurava

[@Caracazz2]

I want to edit my banking app server response to show different balance in the app. Is it possible? Just to troll my friends :D

[@Caracazz2]

It didn't work. The app uses SSL pinning :(

[@kleberpereira8503]

Good morning, could you make a video how to get around SSL fixing? To be able to access apps and see how requests from those apps?

[@JSONSEC]

Its in my backlog :)

[@kleberpereira8503]

@@JSONSEC Ok! I appreciate it

[@PiduguSundeep]

Most of the apps are signed and you have to change the manifest file to actually look at the traffic from the app I would like to know that in detail in the next video.

[@JSONSEC]

At the time of recording that was quite rare, but I have found a way to bypass that without recompiling the app with an modified manifest. Stay tuned for that tutorial

[@PiduguSundeep]

@@JSONSEC Much needed for me, waiting for the tutorial.

[@xcrowzzdoe3647]

@@JSONSEC Is that part out yet ? Recompiling every apps is a rather daunting task

[@gaznador2749]

@@JSONSEC Any updates?

[@ajay0rawat]

​@@JSONSEC sir, anything on this topic?

[@crackingforall7075]

in some apps they can't be debugged and get their api (connection error) any solution

[@JSONSEC]

Check all your process, if still erroring then it's an SSL pinning issue which theoretically can be bypassed, I just haven't done so yet.

[@giovannidimarco8170]

Bro thanks so much, but i have One problem why with much apk It give connection error

[@JSONSEC]

Could Have SSL pinning enabled? =/

[@rajasekharreddy7686]

good bro

[@x.698]

i want ask you > why i can't see all request in burp andriod or ios

[@JSONSEC]

Youll probably find your requests are only HTTP and no HTTPS which means you need to install the burp as Root CA on Local Machine

[@foxgameplay5449]

bro i need help some apps cannot be intercept even with ssl bypass what to do in this case ??

[@JSONSEC]

Can you get a build of the app without SSL pinning enabled?

[@foxgameplay5449]

@@JSONSEC what that does mean buit of the app

[@abuabdulmuhsin]

Hi. any idea to intercept android websocket ?

[@JSONSEC]

Good question, you may be able to with the same process but change the proxy type... I'll have to play around with it. 🤔

[@Teaching_crack]

Hi i dont have same wifi how to use without same wifi i need get capture request app

[@JSONSEC]

The tutorial is built around the Alpha as it has specific drivers required for this. You can get one on Amazon for pretty cheap

[@mohammadyunus2156]

I'm having difficult time rooting my Samsung J5 prime, can anyone share me any resources which would help?

[@JSONSEC]

Head over to xda developers. That's what they're known for ☺️

[@anolghosh9501]

is there any possibilities to non rooted android?

[@JSONSEC]

I haven't checked in recent years, but you needed root to install a root CA, it might be different now

[@7.many.]

My wifi doesn't work when i put my pc ip in it

[@JSONSEC]

Its normal to get that error message, make sure you disable Intercept so traffic can flow and that you've installed the ROOT CA

[@tommyhili6805]

Is there anything just with a simple app on my phone lol? I'm sure their is something no?

[@JSONSEC]

Don't think so....🤔

[@nowonder9466]

Is it just me or does he remind you of kody from null bytes

[@JSONSEC]

I hope my content is as helpful as his!

[@r0x304]

videos not synced properly

[@FahadAli-ot5kn]

What if it if the phone is nonrotted

[@JSONSEC]

You can't install the root certificate then

[@Jonas-gm4my]

Does this work with fiddler?

[@JSONSEC]

Yep, just import the fiddler cert

[@exeyeveennersection422]

How does my girlfriend that comes every weekend intercept my traffic ? I'm pretty sure someone is helping her . The sneaky link pretty eyed scary badass hacker , because I'm doing shit on purpose just to see what she says. I just can't figure out WTF. Someone please help me out with this. Could she be apart of the IETF?

[@dandysitompul]

can i use android smartphone non rooted?

[@JSONSEC]

Sadly not, but you can look at using a rooted virtualised android

[@dandysitompul]

@@JSONSEC in browser it's works. But why i can't intercept in mobile application?

[@dandysitompul]

i'm already change it from "wifi" to "vpn and appsz" but it still not working

[@anujkumarpatel2686]

i am tring to proxy zomato but its not working

[@JSONSEC]

I'm afraid you're going to have to be a bit more specific... What's not working? Have you got any error messages in Burp? Have you checked if the APK has SSL pinning?

[@anujkumarpatel2686]

@@JSONSEC thanks for your reply it showing some kind of error in burp tls/ssl connection failed that you showed in video btw i am doing this in emulator(genymotion)

[@supremesilver1295]

Work with fiddler ?

[@JSONSEC]

I haven't tested it, but I don't see why not.. Let me know how you go!

[@pvp8875]

can you please let us know how to do this for Android 9 and above and for ios devices

[@JSONSEC]

This video was done on Android 9. You can also find the iOS video on my channel

[@pvp8875]

Thanks! Also one question, just with my understanding perspective, as you mentioned about SSL pinning removal. So in real world, does that mean, if your app is SSL pinned then its traffic over internet cannot be viewed ? Because say, If we find any security issue using burp and report it to developer , they will say you are using Non- SSL pinned app version which will not be the case in production and thus the reported issue can become invalid to fix.

[@JSONSEC]

Oooooo what great questions! SSL pinning will just make sure that only the certificate it's bundled with can decrypt the traffic as opposed to any trusted certificate. HOWEVER, if you find a bug / vuln in the system regardless of what Certificate is being used, it should still be considered as the same risk. I'm sure you've heard the saying 'Security is layered line an onion'. That would be my justification. You'd want to plug any holes you see, as if one gets bypassed, you'd rely on another to stop any bad actors.

[@yashwanthd1998]

android 11 doesnt allow this

[@I4MDD]

i am using hotspot from phone

[@JSONSEC]

Shouldn't matter, be sure to just connect to the devices local ip

[@P..]

"You do not seem to have root"

[@JSONSEC]

Are you using a rooted device?

[@P..]

@@JSONSEC Nope, I guess not. I needed up giving up. Thanks for the reply though.

[@DSP-gh5ei]

​@@JSONSECMust be rooted? Thanks

[@user-kr6gv7sg2p]

нужен сниф не андроида, а андроид приложения на андроиде! Это чуть чуть разные вещи же!

[@trix7450]

how do i root device?

[@trix7450]

i have samsung j3

[@JSONSEC]

Check out XDA developers

[@hunainahmed3217]

I'm still confused that everyone's saying that it requires root to intercept and I also witnessed it before root, but I remember it perfectly intercepted the first time I connected, dunno how?????!!!

[@JSONSEC]

If you find out, I'd love to know! Apps only trust Root Certificates, which you can only import as root.

[@TechnicalHeavenSM]

Does my device need to be rooted?

[@JSONSEC]

Almost certainly

[@TechnicalHeavenSM]

@@JSONSEC ooo

[@paulvandriel2344]

Man, you should work on your speech problem. Urrrr

[@JSONSEC]

Thanks for the feedback