This last weekend I started testing a new Android app for fun, and ran into some trouble getting Burp Suite working properly. I burned a whole afternoon troubleshooting the issue, and decided to write up what I found out and two different ways I got it working.
I’ve done quite a bit of Android testing in the past and my setup usually involves a Genymotion VM or my old rooted Nexus Tablet. I run Burp Suite locally, install the User Cert as outlined in Portswigger’s documentation, configure a WiFi proxy and I’m off the races.
This particular app I wanted to test, however, required a minimum API level 24 (Android 7.0 – “Nougat”) and suddenly it wasn’t working. I followed the steps I always do but saw nothing but “connection reset” errors in Burp:
After a few frustrating hours of troubleshooting, I finally figured out the issue lied with the latest versions of Android (API >= 24). Before I go any further, all the information I needed was found in these great write-ups:
Starting with Nougat, Android changed the default behavior of trusting user installed certificates. It’s no longer possible to just install the Burp CA from the sdcard to start intercepting app traffic. Unless otherwise specified, apps will now only trust system level CAs. The failure happens “invisibly” and is responsible for all the alerts I saw in Burp Suite.
There’s two ways to bypass this, and I’ll walk through them both.
- Install the Burp CA as a system-level CA on the device. My recommendation for the easiest solution, but does require a rooted device. Also added benefit of not having to set a lockscreen PIN :)
- Modify the manifest and repackage the app. Slightly more work, but doesn’t require root privileges.
Note: I did all this with Burp Suite Pro on my Windows 10 machine and am using an Android 7.1 (API25) Genymotion VM, but the steps should be applicable to any setup.
Install Burp CA as a system-level trusted CA
Since the “traditional” way of installing a user certificate doesn’t work anymore in Nougat and above, for me the easiest solution is to install the Burp CA to the system trusted certificates. You can see all the system CAs that are bundled with an Android device by going to Settings -> Security -> Trusted Credentials and viewing system CAs. You’ll see the similar CAs you’d see in a browser bundle.
Trusted CAs for Android are stored in a special format in
/system/etc/security/cacerts. If we have root privileges, it’s possible to write to this location and drop in the Burp CA (after some modification).
Export and convert the Burp CA
The first step is to get the Burp CA in the right format. Using Burp Suite, export the CA Certificate in DER format. I saved it as
Android wants the certificate to be in PEM format, and to have the filename equal to the
subject_hash_old value appended with
Note: if you are using OpenSSL <1.0, it’s actually just the
subject_hash, not the “old” one
openssl to convert DER to PEM, then output the
subject_hash_old and rename the file:
openssl x509 -inform DER -in cacert.der -out cacert.pem openssl x509 -inform PEM -subject_hash_old -in cacert.pem |head -1 mv cacert.pem <hash>.0
For example, with my certificate:
Copy the certificate to the device
We can use
adb to copy the certificate over, but since it has to be copied to the
/system filesystem, we have to remount it as writable. As root, this is easy with
adb root adb remount adb push <cert>.0 /sdcard/
The just drop into a shell (
adb shell) and move the file to
/system/etc/security/cacerts and chmod it to 644:
mv /sdcard/<cert>.0 /system/etc/security/cacerts/ chmod 644 /system/etc/security/cacerts/<cert>.0
Lastly, we have to full reboot the device with either
adb reboot or a power cycle.
After the device reboots, browsing to Settings -> Security -> Trusted Credentialsshould show the new “Portswigger CA” as a system trusted CA.
Now it’s possible to set up the proxy and start intecepting any and all app traffic with Burp :)