Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

how can I see the app transfer contents with SSL

nobody | Last updated: Oct 03, 2017 07:56AM UTC

I want to See android Apps packets content via BurpSuite I’ve installed CA, but there still are some apps can't be seen and even can't load the info. But if I choose Pass SSL, the app still can work well is there any way can solve the problem thank you

PortSwigger Agent | Last updated: Oct 03, 2017 08:41AM UTC

Hi, The apps that you can't proxy are using certificate pinning. The certificate of the legitimate back-end service is hard coded in the application, and it rejects Burp's certificate. There are some tools that can disable pinning in some circumstances, including SSL Trust Killer and JustTrustMe. However, they don't work in all circumstances - especially if the app does pinning in bespoke code. In that case, the only option is to modify the app to remove pinning, and repackage it. That is quite complex, and requires good knowledge of Java and Android. Please let us know if you need any further assistance.

Burp User | Last updated: Oct 05, 2017 12:50AM UTC

Thank you. I'll try it first, hope it can work well.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.