Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

how can I see the app transfer contents with SSL

nobody | Last updated: Oct 03, 2017 07:56AM UTC

I want to See android Apps packets content via BurpSuite I’ve installed CA, but there still are some apps can't be seen and even can't load the info. But if I choose Pass SSL, the app still can work well is there any way can solve the problem thank you

PortSwigger Agent | Last updated: Oct 03, 2017 08:41AM UTC

Hi, The apps that you can't proxy are using certificate pinning. The certificate of the legitimate back-end service is hard coded in the application, and it rejects Burp's certificate. There are some tools that can disable pinning in some circumstances, including SSL Trust Killer and JustTrustMe. However, they don't work in all circumstances - especially if the app does pinning in bespoke code. In that case, the only option is to modify the app to remove pinning, and repackage it. That is quite complex, and requires good knowledge of Java and Android. Please let us know if you need any further assistance.

Burp User | Last updated: Oct 05, 2017 12:50AM UTC