GuidesUsing Burp Suite with Corellium

Using Burp Suite with Corellium

How to get started using your Corellium virtual device with Burp Suite.

In this guide, we'll be setting up a Corellium Android virtual device with the popular proxy tool, Burp Suite. We'll be using a Mac with Burp Suite Community Edition 2020 and a virtual Android 11 device.

Before you get started, quickly make sure that you've downloaded the Open VPN file for your virtual device and that you're connected to VPN using that profile.

Configure Burp

Navigate to the "Proxy" tab in Burp, and then select "Options." Click on the current interface, and select "Edit." In the popup that appears, select the option for "All Interfaces." Here, take note of the port number (8080) as well as the VPN IP Address (10.11.3.2). We'll need these later when we configure the APN settings on the Virtual Machine. If you want to check that the IP Address is accurate, you can quickly run ifconfig in Terminal to validate it.

Select "OK," then select "Yes" for "Listen on all interfaces," and then "Allow" on "Accept all incoming network connections."

CA Certificates

On the same Proxy -> Options screen, export your CA Certificate and save this to our desktop for easy upload. Then, switch over to your Corellium virtual device screen and go to the Files tab. In Files, navigate to Mnt -> Sdcared -> Download folder, and upload the CA Certificate there.

To install the certificate, connect to Display on the virtual device screen, and navigate to the virtual device's Settings app. In Settings, go to Security -> Encryption and credentials -> Install a certificate -> CA certificate. Here, click the top-left menu icon, and select Downloads. Then, select the your certificate.

Configure APN

Navigate back to the Settings app home page and select Network and internet -> Mobile Network -> Advanced -> Access Point Names -> Select the network. Here, enter the IP Address from Step 1 in the Port and Proxy fields, then click Save.

Troubleshooting

If you have set up your proxy and are not able to see traffic, try closing and restarting your VPN session. Ensure that you are able to ping the IP address from the virtual device console.

Remember, you may not be able to reach HTTPS websites without proper trust certificates installed.

If the issue still persists, contact your network administrator to determine if any local network configurations may be blocking or interfering with the virtual device network.

Validate

To validate Burp is intercepting traffic, do a quick web search in the virtual device's Webview. You will see the request in Burp, and then as you forward the request you will see the the VM respond.

That's all there is to it! Thanks for taking the time to read this and happy virtualizing!