Using Burp Suite with an Android emulator

In this video, I will be using Burp Suite to intercept requests from an Android emulator.
If you need help getting the Burp Suite certificate installed on your emulator, check out my previous video here: • Install a Burp Suite c...
Check out my blog here:
corsecure.blog

[@0xfsec]

Love this android series! Found your channel and subscribe after listening, Joel Margolis - critical thinking (podcast) ep. 6 about mobile hacking. I hope to watch more awesome content on hacking android/mobile from you!

[@Origameasy]

You can actually change the proxy settings more easily by clicking on the 3 dots next to your emulator window then settings > proxy > manual proxy configuration

[@DJGalaxyAce]

Hi, have you encounter before the Burp proxy only works if I configure in the AVD itself, however if I configure the proxy through emulator command line or the emulator setting page, the proxy not working. Any idea how to solve it?

[@cim0hamed]

thank you so much

[@whatsup5442]

Using the default browser, I didn't get any warning about security, on chrome it doesn't work without saying something about security.

[@ajay0rawat]

How to see the encrypted data packets received form android apps by proxying through burpsuite. I am not able to read the encrypted text from the data packet..plz help

[@camilozuluaga771]

what about if Burp is running on a VM NAT mode? tried port forward on the hypervisor settings in case VirtualBox, but didn't work.. the only way to make it work is to change to bride mode.

[@wolfrevokcats7890]

Do you run the Burp on the host or inside Parrot VM?

[@GabrielCosta-vp9fc]

I´m getting the "adbd cannot run as root in production builds" error when trying to adb root. Any ideas how to solve it?

[@CorSecure]

make sure you are using the -writable-system flag when launching the emulator, and also make sure your emulator was built using a system image that does not have Google Play enabled. this Stack Overflow thread might be helpful: stackoverflow.com/questions/53662102/adb-root-command-returns-adbd-cannot-run-as-root-in-production-builds-even-o

[@rahulsrivastava8576]

what ip address to use if using a physical android phone in proxy host name

[@CorSecure]

If you are using a physical device, you need to use the IP address of your machine that is running Burp. Your android device will also need to be on the same network as your computer so it can talk to that address. Once you find that IP address, set both the Burp proxy listener and the proxy hostname on the android device to that IP.

[@Valentin439]

so If we install certificate in system there is no need anymore to deal with SSL pinning?

[@CorSecure]

no those are separate mechanisms. you have to install the certificate in order to intercept any HTTPS traffic from the mobile device with a proxy. then after the certificate is installed, then you might need to bypass pinning if the app you're testing has it enabled.

[@user-el1ty3gb4q]

I am getting wifi can't provide internet after setting proxy...plz help me

[@CorSecure]

There's a checklist you can go through whenever you have proxy issues. 1. Did you properly install the proxy certificate on the device? I have a video about installing the certificate if you need help with that: kzbin.info/www/bejne/gJiXmayQm6uHmsU 2. Is your computer on the same network as your mobile device? (this doesn't apply if you are using an emulator) 3. Is your proxy listening on the correct interface? If you are using an emulator, it should be 127.0.0.1. If you are using a physical device, it will probably be an IP starting with 192.168. 4. Is the proxy settings on the mobile device set to the correct IP? I talk about setting the proxy on the device in this video. 5. Do you see web traffic from the web browser on the mobile device? If you see traffic from the web browser and not the app, then the app may have SSL pinning enabled. I have a video about bypassing SSL pinning here: kzbin.info/www/bejne/iWm0pWSajMuDoNU I also have some blog posts on my website related to both installing the certificate and bypassing SSL pinning that might be helpful. corsecure.blog

[@thefamousdjx]

in chrome i get 'ssl pinned key not in cert chain error'. I installed burp certificate in system already. Any clues?

[@CorSecure]

Is this just happening in Chrome or for applications too? I found this article that suggests it could be related to HSTS. www.gogetssl.com/wiki/problems/err_ssl_pinned_key_not_in_cert_chain/

[@wolfrevokcats7890]

Another way to set proxy via adb. I prefer this way, easier and faster to change proxy adb shell settings put global http_proxy :