How to Use Burp Suite with Android: Proxy Setup Guide | Vooki Pro

How to use Burp Suite with an Android device

This guide shows how to route an Android device's traffic through Burp Suite, so you can see the requests an app sends. Use it only with apps and systems you own or are authorised to test.

Part 1: point the device at Burp Suite

  1. On the device, open Settings and tap Wi-Fi.
  2. Long-press the network you are connected to.
  3. Tap Modify network.
  4. Set Proxy to Manual.
  5. Enter the proxy hostname (the IP address of the computer running Burp Suite) and the proxy port, then tap Save.
  6. On the computer, open Burp Suite and click Proxy.
  7. Click Options.
  8. Select the proxy listener and click Edit.
  9. Set Bind to port and Specific address to the same values you entered on the device in step 5, then click OK.

Part 2: test with an HTTP site

Open an http:// URL in the device's browser.

The page loads:

And the request appears in Burp Suite under Proxy → HTTP history:

Now try an https:// URL:

The device shows a certificate error, because it does not yet trust Burp Suite's certificate:

Part 3: install Burp's CA certificate for HTTPS

  1. In Burp Suite, click Import / export CA certificate.
  2. Select Certificate in DER format and click Next.
  3. Click Select file.
  4. Choose a location, give the file a name ending in .cer, and click Save.
  5. Click Next.
  6. Click Close.
  7. Copy the certificate file to the device.
  8. On the device, open Settings and tap Security.
  9. Tap Install from SD card (on newer Android versions: Install a certificate).
  10. Select the certificate file.
  11. Enter a certificate name, for example cacert, and tap OK.
  12. Open the https:// URL again.

The page now loads:

And the HTTPS request appears in Burp Suite:

You can now monitor the traffic from the device.

Good to know

  • From Android 7, apps do not trust user-installed certificates by default, so this method works for the browser and for apps configured to allow it. Apps that use certificate pinning need additional steps.
  • When you finish testing, remove the proxy setting and the installed certificate from the device.

How Vooki Pro helps

  • After you capture an app's API traffic, Vooki Pro can scan those APIs automatically.
  • Import captured traffic as a HAR file, or individual requests as cURL, into the API Builder.
  • Scans the whole API project with authentication and automatic re-login.

Frequently asked questions

Why proxy Android traffic?

To see exactly which API requests an app sends, so you can test them.

Why does HTTPS traffic not appear?

Modern Android versions do not trust user-installed certificates for apps by default, and some apps use certificate pinning.

Try Vooki Pro free for 7 days

Turn captured mobile traffic into an automated API security scan. The trial unlocks every feature for 7 days, and scanning runs on your own machine.

Get Vooki Pro →  ·  Importing and exporting: OpenAPI, Postman, HAR and scans

Related: How to security-test a REST API from OpenAPI or Postman · The OWASP API Security Top 10, explained