Burp Suite User Forum

Create new post

Burp interception with certificate pinning

Garry | Last updated: Oct 03, 2017 12:20PM UTC

Hi, Just want to know how to intercept the mobile app traffic on Burp with certificate pinning ? I believe man-in- the- middle attack setup is not possible with certificate pinning in the app Appreciate quick response on this

PortSwigger Agent | Last updated: Oct 03, 2017 12:25PM UTC

Hi Garry, Thanks for your message. There are some tools to try to bypass certificate pinning, including Burp Mobile Assistant for iOS and third party Android tools - SSL Trust Killer, JustTrustMe. If this is Android, you may do better to run an older version. The latest Android has introduced new restrictions on certificate installation. Please let us know if you need any further assistance.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.