Install a Burp Suite certificate in an Android emulator

In this video, I walk through exporting a certificate from Burp Suite and installing it on an Android emulator.
Check out my blog here:
corsecure.blog

[@testerman-g7g]

Works perfectly, thanks man!

[@KilluaTheBeatMaker]

thanks for the help sir best toturials I've ever seen

[@trueToastedCode]

thx dude it worked perfectly on android 13 emu

[@ajthescot]

Necro posting but got a question everything is as shown .when i ls in system/etc/security/cacerts mine is there with correct permissions. But when i browse trusted on emu it doesn't show in list .and burp doesnt run any traffic

[@CorSecure]

That is strange. I've never had that issue before. If the certificate file was properly formatted and is in the cacerts directory, then it should show up in the certificates list on the device. The only other thing that I can think of is to make sure that you reboot the emulator with adb reboot. If you still can't solve this issue, another option would be to use a user certificate. You will most likely need to make some edits to the APK that you are testing though. kzbin.info/www/bejne/joLVlWaPgJmcsLM

[@gravelpitty]

@CorSecure Thanks a lot for this series of videos. I failed to install for a couple of hours due to unsupported Android versions. I can confirm it works for the following combination, tough: Pixel_5_API_31 API 34 does not seem to work anymore, can you confirm this? The root certificate is there in the folder with the correct permissions, I rebooted, but it would not show up in the trusted certificates section.

[@CorSecure]

I haven't tried it with API 34. I have actually recently started using a different method for installing certificates that I think is a bit more consistent. I'm planning on making a video updating some of these things that may have changed slightly since I uploaded some of these older videos.

[@martindoherty92]

@@CorSecure I will be awaiting this video having problems with certificates and API 34 as well

[@ezhil56x]

The tutorial was great I could intercept everything in the chrome browser but Im not getting internet insider the applications like youtube and instagram it shows connect to internet ans wifi is always crossed Pls help me at the earliest !

[@CorSecure]

Those apps may have SSL pinning enabled. I have 2 videos where I show a couple different ways to bypass SSL pinning if you want to check those out. kzbin.info/www/bejne/iWm0pWSajMuDoNU kzbin.info/www/bejne/p5Ktc4qZqsp2f6M If you want to make sure the proxy is working for apps that do not have pinning enabled, you can try the Twitch android app.

[@javaboy6581]

Very good video I need this for testing apps in android studio. Thanks! Error: I got this error -> adbd cannot run as root in production builds, but I have rooted my AVD, I can do adb shell and get root, but command adb root not work, why?

[@CorSecure]

Make sure you did not choose one of the system builds that has the Play Store enabled. Also use the -writable-system flag when you launch the emulator from the command line. Here is a Stack Overflow thread that I found that might be helpful: stackoverflow.com/questions/43923996/adb-root-is-not-working-on-emulator-cannot-run-as-root-in-production-builds

[@javaboy6581]

@@CorSecure Wow thanks for your response! I don´t think you will do it. I checked all stackoverflow before hehe, but I don´t check that you have a playlist about this, sorry. I discover my error, use API upper 28. When I downgrade to 28 it works like a charm. I am seeing all your playlist because a need certificate pinning for testing apk (Smart Life) that controle all lights and sockets in my room and kitchen . I will subscribe to your twitch if I see you online. Thanks!

[@kamalpdubeyy]

Sir I'm getting an error as ('head' is not recognised as internal or external command) please help.

[@CorSecure]

I assume you are getting this error from the command at 9:30. If you are using a Windows machine to do this, that won't work since "head" is a Linux command. I'm not sure what the equivalent would be for Windows. You can just remove the "|head -1" part of the command, and the output will be much longer. You will just need to copy the first 8 characters and use that on the next step.

[@laurentiutrifan9092]

@@CorSecure lifesaver! Thanks 1000 times! I do have a hunch that it should be in hexadecimal format though, as my first 8 characters include M, I, q....

[@cim0hamed]

thank you sir

[@dusilva3796]

Can't we just upload the .der file to the emulator and install it as a CA certificate?

[@CorSecure]

You can in older versions of Android. That only installs it as a user cert though, and since Android 7 applications do not trust user certificates by default. If you want to trust a certificate on modern Android devices, either the application has to explicitly trust user certificates (which usually requires editing the source code of the app) or you have to install the certificate as a system certificate.

[@dusilva3796]

@@CorSecure understood i was thinking that some apps didint appear in the burpsuit because of certificate pinning but it may be because I installed the CA certificate the wrong way. Thanks for the anwser

[@lanced1457]

As an individual of the public & allegedly " equally " treated as anyone else by the "Inju Sys"... I owned a cellular phone and never had an issue for a decade . 10 years of peace . I physically opened something that caused me to be permanent digitally destryd. I'm on cell dev #11 & still own the other ten phones that nobody will touch . Summary = 1 phone for almost ten years , unknowingly did something unintentionally and in 1 year ,JUST A LITTLE OVER THREE HUNDRED DAYS , ten phones were internally & bizarrely deemed unusable for unknown reasons. I have taken a few phones to businesses just to be denied services or a sliver of an answer. I welcome anyone who thinks they can deal with this bs to a phone . I will only send it after discussion. I need help from anyone who is ethically motivated for good not bad.

[@lanced1457]

I can create paper and ink and turn it into a thesaurus or dictionary although I cannot spell for anything. Understand the analogy? I need help from a professional in this field of intelligence..1 I

[@B602R]

After remount ill get the notification that the device has to be rebooted for settings to take effect. But "adb reboot" will crash the whole system, also manually restarting will fully crash the whole adb. Any tipps on that one?

[@CorSecure]

I have seen that before on some devices. have you tried running the remount again after rebooting the emulator?

[@B602R]

@@CorSecure As soon as I remount, the reboot will crash the emulator completely. Currently im testing if its due to a problem with the emulator itself. What setup (Device / API Lv.) was used in your video?

[@CorSecure]

@@B602R I have another video where I walked through setting up an emulator with Android Studio that you can see here kzbin.info/www/bejne/ZqPdaX6YndyFbNU. I am using the same emulator that I made in that video. You can skip to around the 4:30 mark to see the options that I chose when building my emulator.

[@B602R]

@@CorSecure Very special. Really seems like a problem with the newest API. Using the older one, makes it work perfectly fine. Thank you very much :)

[@CorSecure]

@@B602R no problem. glad I could help! :)

[@Valentin439]

thank you

[@haroldabella2041]

after this openssl x509 -inform PEM -subject_has_old -in burcert.pem |head -1 i'm getting this 'head' is not recognized as an internal or external command any idea how to solve this? Thank you. windows 11 btw

[@CorSecure]

"head" is a Linux command. I'm not sure what the equivalent would be for Windows. You can just remove the "|head -1" part of the command, and the output will be much longer. You will just need to copy the first 8 characters and use that on the next step.

[@ParthMaharaja]

@@CorSecure , you are awesome teacher.... Thank you!

[@user-gh6iy9rf3x]

root required? adbd cannot run as root in production builds means?

[@CorSecure]

Yes. Root is required to install the burp suite certificate using this method.

[@WoodyTso]

Sir, I would like to ask how can I remount /system. I try a lot of souldtion and still not work. Do you have any idea of how to fix? Thank you!

[@WoodyTso]

I can run as adb root but can't run adb remount

[@CorSecure]

If you are using an emulator, make sure you launch the emulator with the --writable-system flag. Also, this Stack Overflow thread has some responses that might be helpful. stackoverflow.com/questions/13089694/adb-remount-permission-denied-but-able-to-access-super-user-in-shell-android

[@WoodyTso]

@@CorSecure Thank you for responning my dump question. It seems like I didn't include the flag. 🙇‍♂🙇‍♂

[@WoodyTso]

@CorSecure when will you stream in twitch? I would like to watch

[@CorSecure]

@@WoodyTso I don't really stream anymore. making videos offline is a lot easier for my schedule, and I think the content is better too.

[@Hybrid-le9oj]

x509: Use -help for summary.