Configuring an Android device to work with Burp Suite - Port Swigger
Summary: PortSwigger's guide explains how to route an Android device's HTTP traffic through Burp Suite by configuring a proxy listener bound to an open port, noting that from Android 7 (Nougat) onward some steps require a rooted device. To intercept HTTPS, the user must add Burp's built-in certificate authority to the device's trust store so Burp can impersonate the target server during the TLS handshake, and PortSwigger states it has chosen not to document that certificate step itself.
What's compelling: The same interception setup PortSwigger describes for app testing - a proxy and a trusted CA certificate that lets a tool impersonate any server - is what a rooted device with a user-installed root CA hands to anyone who controls that certificate, and PortSwigger itself warns that rooting fundamentally compromises the device's security model.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026