KiloClawPowered by OpenClaw
Back to Cookbook
OpenClaw recipe

Android 7+ App HTTPS Interception Setup

aka “Mobile HTTPS Interception on Android 7+”

Fix "traffic in browser but not in apps" via Network Security Config

Android Nougat changed CA trust defaults — apps targeting API 24+ ignore user-installed CAs. This breaks typical Burp/mitmproxy interception. Walks through Network Security Config debug overrides for builds you control and scoped fallback options for test devices when you don't.

House RecipeWork12 min
Try in KiloClawFree 7-day trial

INGREDIENTS

🌐Browser

PROMPT

Create a skill called "Android 7+ MITM Troubleshooter". Inputs I will provide: - Android OS version and whether it's a physical device or emulator - Whether I control the app build (debuggable) or not - Burp listener details and whether browser traffic works - Any error logs (SSLHandshakeException, trust anchor errors) Task: 1) Diagnose whether the failure is due to Android CA trust defaults. 2) Provide a preferred fix path: - Debug build using Network Security Config debug overrides. 3) Provide a controlled fallback path for test devices if build changes are impossible. 4) Include a cleanup checklist to remove certificates and revert proxy settings post-test.

What this fixes

Common symptoms:

  • Device browser traffic appears in Burp, but most apps show nothing
  • Apps fail TLS handshake even after installing the proxy CA as a user certificate
  • SSLHandshakeException / "trust anchor not found" errors in logcat

Prerequisites

  • A test device or emulator configured for the engagement
  • Burp configured with a dedicated proxy listener for the device
  • Authorization to test the specific app(s) and permission to modify debug builds (if applicable)

Steps and commands

  1. Configure Burp for the device:
  • Add a dedicated proxy listener (bind to all interfaces, unique port).
  • Export Burp CA certificate (DER) for device installation.
  1. Configure Wi-Fi proxy on the Android device:
  • Set proxy hostname to your Burp host IP and port to the listener port.
  1. Validate baseline with the device browser:
  • Browse to an HTTPS site and confirm traffic appears in Burp.
  1. If app traffic does NOT appear (Android 7+):
  • Default behavior: apps targeting API 24+ do not trust user-installed CAs.
  • Preferred fix: use Network Security Config in a debug build.

Minimal debug override (trust user CAs only while debuggable):

  • `res/xml/network_security_config.xml`:

`

`

  • Reference it in the app manifest (`android:networkSecurityConfig`).
  1. If you cannot modify the app build:
  • Use a dedicated test device/emulator that supports installing the CA into the system store.
  • Treat this as a controlled lab action; understand the security impact and roll back afterward.

Expected outputs

  • Browser and eligible app traffic appears in Burp (Proxy history)
  • Reduced TLS errors once the app trusts the proxy CA

Common errors and troubleshooting

  • Traffic works in browser only
  • Strong signal of Android 7+ CA trust changes for apps.
  • Confirm app targetSdkVersion and whether it opts into user CAs.
  • "Trust anchor for certification path not found"
  • App does not trust the proxy CA.
  • Fix via Network Security Config (preferred) or controlled system-CA installation.
  • Certificate pinning (distinct from CA trust)
  • Some apps pin specific certificates beyond the CA trust model.
  • Requires additional tooling (e.g., Frida/Objection) — out of scope for this recipe.

References

  • https://android-developers.googleblog.com/2016/07/changes-to-trusted-certificate.html
  • https://developer.android.com/privacy-and-security/security-config
  • https://portswigger.net/burp/documentation/desktop/mobile/config-android-device
  • https://docs.mitmproxy.org/stable/howto/install-system-trusted-ca-android/

Example inputs

  • Burp host IP: 192.168.56.1
  • Device proxy port: 8082
  • Target app package: com.example.app
Tags:#pentesting#mobile#android#burp#tls#mitm#troubleshooting

Related Recipes

Burp CA First Aid

Install trust correctly and fix "can't download CA certificate"

Field-tested checklist for getting HTTPS interception working in Burp. Covers Firefox's separate trust store, the http://burpsuite download page not loading, quick verification, and safe post-engagement rollback.

Work5 min

Rootless (or Almost) Network Scans in Containers

Fix raw-socket "Operation not permitted" without --privileged

Least-privilege setup for running Nmap, MASSCAN, or ZMap inside Docker/Podman/Kubernetes. Solves "requires root privileges" and "Operation not permitted" failures without reaching for --privileged. Includes fallbacks when raw sockets are unavailable.

Work10 min

Render Hang Triage

A playbook for "stops at the same frame" and "freeze mid-render" failures

Renders freeze at a consistent percentage or frame — often caused by a bad clip, a heavy effect, a Fusion comp issue, or "stop render on error" settings. This recipe classifies the failure pattern and gives you a structured triage plan instead of blind re-exports.

Creative3 min

Audio Input Lag Fixer

Fix a common Premiere playback-lag issue caused by audio input device settings

Severe playback lag and stutter in Premiere Pro that looks like a codec performance problem but is actually caused by audio hardware input settings. This recipe provides a quick decision tree to test and fix the issue — often resolved in under a minute by switching the default input to "No Input."

Creative3 min