#BURP SUITE PEN TESTER SERIAL NUMBER#
#BURP SUITE PEN TESTER INSTALL#

There are likely a number of ways to get around this by redirecting traffic but we also want to play with that non HTTP/S traffic so for this we will use Mallory Proxy. The problem with setting your devices to use burp is that it only fully handles HTTP/S and websockets, and it tends to drop traffic which does not fit this criteria. When I removed the proxy the application would function so clearly something was amiss. I was testing an application for a client and found that I could intercept the initial login request and response using burp suite, after that the application displayed a spinning wait dial and then closed down. The above scenario will work for 9 out of 10 applications, however every now and then one application will be a pain! Intercepting non HTTP/S traffic with Mallory Thankfully there are some tools which can help us defeat this:

This means our burp certificates (whilst being site specific) are useless.

#BURP SUITE PEN TESTER SERIAL NUMBER#

Certificate pinning involves the application checking certain characteristics of the certificate such as serial number or signing hierarchy. If you browse to : you will be presented with a web interface which has a link to the CA file which iOS will importĪt this point you should have most applications running through your burp proxy, hurrah! Some applications make use of certificate pinning to further secure SSL communications.Just setting the proxy in network settings does the job.I have had issues importing certificates into burp the normal way and found this guide always works.Proxy droid is a nice application to enable your proxy on certain apps only.

#BURP SUITE PEN TESTER INSTALL#

You will also need to install the proxys CA on your device so you don’t get any pesky SSL errors, here are some tips:

The easiest way of doing this is setting the proxy within the network settings of your device to talk to burp. Typically when performing a mobile app test the first step is to get the app talking through some form of proxy so you can view and fiddle with the underlying requests to the remote web services. Unlike web apps mobile apps bring their own set of unique problems that test the patience of any security consultant. Mobile application testing seems to becoming as common, if not more so, than testing good old standard web apps.

Burp suite pen tester