# 🧨 Installing Burp CA into Android System CA (Pixel / Android 14+) So you wanna intercept HTTPS on a real Android device without apps screaming **SSL ERROR!!111** every 5 seconds? or crash? Welcome to *system trusted CA* land — where Burp becomes a **first-class certificate authority**. (This is where the fun begins.) This guide shows you how to drop Burp's CA into `/system/etc/security/cacerts/` using a **Magisk systemless module**, because touching real system partitions in 2025 is basically asking your Pixel to self-destruct. Works on: - Pixel 6/7/8, Android 12 → 14+ - Magisk (Zygisk) - Rooted devices - Humans with basic terminal skills Let’s go. 🚀 --- ## 🔥 Step 1 — Grab Burp’s CA Open Burp → Proxy → Options → *Export CA certificate* → choose **DER** format. Save it as: ``` cacert.der ``` Clean. Simple. Professional (not really). ## 🔥 Step 2 — Convert DER → PEM ```bash openssl x509 -in cacert.der -inform DER -out burp.pem -outform PEM ``` If you see `burp.pem`, you're winning. ## 🔥 Step 3 — Android wants the old-school hash name Android still uses this ancient OpenSSL hash system. So we generate: ```bash HASH=$(openssl x509 -in burp.pem -subject_hash_old -noout | head -n1) echo $HASH ``` Example output: ``` 9a5ba575 ``` Congrats, you now have a “name”. ## 🔥 Step 4 — Create `<hash>.0` Android expects your CA to be named like this: ```bash cp burp.pem ${HASH}.0 ``` This is literally how Linux organizes certs. Not even joking. ## 🔥 Step 5 — Build the Magisk module (systemless flex 💅) Create the module structure: ```bash mkdir -p burp-ca/system/etc/security/cacerts cp ${HASH}.0 burp-ca/system/etc/security/cacerts/ ``` Make a module description: `burp-ca/module.prop` ``` id=burpca name=Burp CA (systemless) version=1.0 versionCode=1 author=y0un9x description=Install Burp CA into Android system trusted CA store using Magisk overlay ``` Boom. That's your module. ## 🔥 Step 6 — Zip it ```bash cd burp-ca zip -r ../burp-ca.zip . cd .. ``` You should now have: ``` burp-ca.zip ``` This is your golden ticket to system CA land. ## 🔥 Step 7 — Flash with Magisk Send it to your phone: ```bash adb push burp-ca.zip /sdcard/Download/ ``` On device: **Magisk → Modules → Install from storage → burp-ca.zip** Reboot. Pray to the Google gods (optional but recommended). ## 🔥 Step 8 — Verify ```bash adb shell su ls -l /system/etc/security/cacerts/ | grep <your hash> ``` If you see: ``` 9a5ba575.0 ``` You’re officially inside the system CA store. Burp is now a fully trusted authority (kinda scary tbh). ## 🎉 You’re done. Enjoy your shiny system-wide MITM. Any HTTPS Android app that **doesn't** use certificate pinning → now bends the knee to your Burp proxy. Use responsibly. Or… at least… don’t get fired. <small>If this setup somehow refuses to work… just drop a comment, I’ll help you uncurse your phone 🔥<small>