Android HTTPS Interception with Genymotion + Burp – Walkthrough

🎯 Objective

Set up a Genymotion Android VM to intercept and inspect HTTPS traffic from apps using Burp Suite. We’ll install ADB, add Burp’s CA certificate into the system trust store (rooted emulator), and route device traffic through the proxy.

Legal note: Intercept only traffic for apps/systems you own or are explicitly authorized to test. Use this guide for lawful security testing and learning.

🧩 What I’m doing

You found bugs while reviewing APKs and want to see the live requests (including TLS). The plan:

• Spin up a Genymotion device (rooted by default).
• Install ADB on the host.
• Fetch Burp’s DER certificate, convert to PEM, compute the legacy subject hash, and install it into Android’s system CA store.
• Proxy all traffic to Burp for inspection.

🧰 Prereqs

• Genymotion Desktop (free account, select a free virtual device / Android version).
• Burp Suite running on your host (default: 127.0.0.1:8080).
• ADB on host (Linux example shown).
• Host and VM can reach each other (host-only or bridged networking).

Install ADB (Ubuntu/Debian):

sudo apt-get update
sudo apt-get -y install android-tools-adb

🧭 Steps I Took

1) Start Burp & export its CA certificate (DER)

With Burp’s proxy listening (e.g., 0.0.0.0:8080 if you want the VM to reach it):

curl http://127.0.0.1:8080/cert -o cert.der

2) Convert DER → PEM and compute legacy subject hash

Android’s system store expects files named <subject_hash_old>.0.

# Convert to PEM
openssl x509 -inform der -in cert.der -out burp.pem

# Print legacy subject hash (the first line printed is the filename stem)
openssl x509 -inform PEM -in burp.pem -subject_hash_old -noout
# example output: 9a5ba575

# Rename to <hash>.0
hash=$(openssl x509 -inform PEM -in burp.pem -subject_hash_old -noout)
cp burp.pem "${hash}.0"

Tip: You can verify the subject quickly:

openssl x509 -inform PEM -in "${hash}.0" -noout -subject

3) Connect to the Genymotion device with ADB

adb devices -l  # confirm it shows up
adb root        # Genymotion usually supports this
adb remount     # remount /system as rw (equivalent of mount -o rw,remount /system)

If adb remount fails, try inside a shell:

adb shell
su
mount -o rw,remount /system
exit
exit

4) Push Burp CA into the system CA store

adb push "${hash}.0" /system/etc/security/cacerts/
adb shell chmod 644 /system/etc/security/cacerts/${hash}.0
adb shell chown root:root /system/etc/security/cacerts/${hash}.0

Why system store? User-installed CAs (Settings → Security → Install from storage) are ignored by many apps on newer Android when a Network Security Config disallows user CAs. System store makes the CA trusted by all apps (root-only).

5) Point the device at your Burp proxy

Replace the IP and port with your host address & Burp port:

# Set a global HTTP proxy on the device
adb shell settings put global http_proxy 192.168.56.1:8080

# (Optional) verify
adb shell settings get global http_proxy

If your Genymotion VM uses Host-Only networking, the host is often 192.168.56.1. Adjust to your actual topology.

6) Reboot & test

adb reboot

After the reboot, open the device’s browser and try an HTTPS site. In Burp, you should see CONNECTs and decrypted requests. Then test your target app.

📎 Copy‑paste helpers

Clear/disable proxy quickly

adb shell settings delete global http_proxy || adb shell settings put global http_proxy :0

Verify CA file is recognized

adb shell ls -l /system/etc/security/cacerts | grep ${hash}

One‑liner: fetch, convert, hash, push

curl http://127.0.0.1:8080/cert -o cert.der && \
openssl x509 -inform der -in cert.der -out burp.pem && \
h=$(openssl x509 -inform PEM -in burp.pem -subject_hash_old -noout) && \
cp burp.pem "$h.0" && \
adb root && adb remount && \
adb push "$h.0" /system/etc/security/cacerts/ && \
adb shell chmod 644 /system/etc/security/cacerts/$h.0 && \
adb shell chown root:root /system/etc/security/cacerts/$h.0 && \
adb shell settings put global http_proxy 192.168.56.1:8080 && \
adb reboot

🧪 Troubleshooting

• No traffic in Burp

  • Ensure VM can reach host: from Android browser, load http://<HOST_IP>:8080.
  • Confirm http_proxy is set: adb shell settings get global http_proxy.
  • Burp listening on the right interface/port; if needed, change to 0.0.0.0 and firewall‑allow.

• HTTPS still not decrypting

  • Confirm CA placement: file exists in /system/etc/security/cacerts/ with mode 644.
  • Reboot after installing the CA.
  • Some apps use certificate pinning; you’ll need app‑specific bypass (e.g., patching or instrumentation) which is outside this basic setup.

• adb remount fails

  • Use adb root first; some images need: adb shell; su; mount -o rw,remount /system.
  • Pick a Genymotion image that allows root/system remount (older Androids are simplest).

• Proxy loops/No internet

  • Ensure you used the host IP (not the device IP).
  • Clear proxy with the command above, then re‑apply with the correct IP/port.

🔒 Defense (dev notes)

• Add Network Security Config to restrict trust anchors in production builds.
• Enable certificate pinning (with careful failure handling).
• Use TLS/HTTP libraries that validate hostname/CAs properly.
• Guard sensitive APIs with backend checks (authN/authZ, rate‑limits, server‑side integrity checks).

✅ Result

You now have a repeatable lab for Android HTTPS interception:

• Genymotion device → global proxy to Burp.
• Burp CA anchored in system store → TLS fully visible in the proxy.
• You can analyze and debug app requests/responses during authorized security testing.

📝 Credits / Notes

• Commands adapted to your original outline (Genymotion + ADB + Burp CA + global proxy).
• Works best on rooted/older Android images; newer production apps may use pinning requiring additional steps (not covered here).