Using Burp Suite with Mobile Apps

Mobile apps make API requests over HTTP(S) like any other client, so they can be proxied through Burp Suite for inspection and tampering — this works for both iOS and Android per PortSwigger’s official guides (configuring an iOS device to work with Burp, configuring an Android device to work with Burp).

Setup

1. Listen on all interfaces — Burp’s proxy defaults to 127.0.0.1; a phone can’t reach that. In Proxy settings, bind the listener to all interfaces (or your LAN IP) so the mobile device can connect over the shared network.
2. Point the device at Burp — on the mobile device’s Wi-Fi settings, set the HTTP proxy to your computer’s LAN IP and Burp’s port (default 8080).
3. Install the Burp CA certificate — required for HTTPS interception, same in principle as the desktop Firefox flow (burp-suite-firefox):
   • iOS: browse to http://burp (or http://<computer-ip>:8080) from the device, download the CA cert, install the profile, then also enable full trust in Settings → General → About → Certificate Trust Settings (PortSwigger iOS CA guide — dead link)
   • Android: export/install the CA as a user certificate (PortSwigger Android CA guide)

Caveats

• This proxies all device traffic through Burp, not just the target app — expect noise from OS services and other apps.
• Modern Android apps (targetSdk 24+) do not trust user-installed CA certificates by default — proxying their HTTPS traffic requires repackaging the app with a custom network security config, or testing on a rooted device/emulator where the CA can be installed into the system store. See android-emulator-rooted-burp-setup for that workflow.
• Some apps use certificate pinning, which must be defeated separately (Frida/objection on a rooted/jailbroken device).

See also

• android-emulator-rooted-burp-setup — rooted emulator setup that sidesteps the user-CA restriction
• burp-suite-firefox — desktop browser proxying and CA installation
• burp-suite-aws-cli-proxy — proxying CLI tooling through Burp
• owasp-zap — open-source alternative proxy

Sources

• Configuring an iOS device to work with Burp Suite — PortSwigger
• Installing Burp Suite’s CA Certificate in an iOS Device — dead link
• Configuring an Android device to work with Burp Suite — PortSwigger
• Installing Burp Suite’s CA Certificate in an Android Device — PortSwigger