Option A — Simple global proxy via adb
(emulator or device)
This is the fastest way to route device HTTP/S through Burp/ZAP.
1. Start Burp/ZAP on your host and ensure it listens on 8080.
○ If using a physical device, either:
■ Run Burp listener on [Link]:8080 (Allow other devices to connect), or
■ Use adb reverse (see Option C) so you can keep listener on localhost.
2. For emulator (host reachable as [Link]) or device on same LAN (replace HOST_IP
with your machine IP), run:
# Emulator (recommended)
adb shell settings put global http_proxy [Link]:8080
# Physical device on same Wi-Fi (replace HOST_IP)
adb shell settings put global http_proxy HOST_IP:8080
3. Verify:
adb shell settings get global http_proxy
# Should print: [Link]:8080 (or HOST_IP:8080)
4. To clear proxy:
# Works on most devices/emulators:
adb shell settings delete global http_proxy
# If that doesn't remove everything, remove explicit host/port keys:
adb shell settings delete global global_http_proxy_host
adb shell settings delete global global_http_proxy_port
adb shell settings delete global global_http_proxy_exclusion_list
Note: Some Android versions use global_http_proxy_host /
global_http_proxy_port keys. The http_proxy single key is shorthand; both
approaches are shown below.
Option B — More explicit global proxy
host/port keys (safer on some devices)
This method sets host/port/exclusion list explicitly.
# Set proxy host + port
adb shell settings put global global_http_proxy_host [Link]
adb shell settings put global global_http_proxy_port 8080
# (Optional) Exclude loopback addresses from proxy
adb shell settings put global global_http_proxy_exclusion_list
"localhost,[Link]"
# Verify
adb shell settings get global global_http_proxy_host
adb shell settings get global global_http_proxy_port
adb shell settings get global global_http_proxy_exclusion_list
# Clear
adb shell settings delete global global_http_proxy_host
adb shell settings delete global global_http_proxy_port
adb shell settings delete global global_http_proxy_exclusion_list
Option C — Use adb reverse (best for
physical devices where host isn't directly
reachable)
adb reverse makes a port on the device map to your host’s port. Useful when the device is
on USB and you want to avoid network configuration.
1. On host, start Burp/ZAP listening on [Link]:8080 (no need to open to network).
2. Create reverse mapping:
# For each connected device/emulator
adb reverse tcp:8080 tcp:8080
3. On the device, set proxy to [Link]:8080 (or set via adb):
# Set as single-key proxy (device will send traffic to localhost:8080
which adb maps to host)
adb shell settings put global http_proxy [Link]:8080
4. Verify connectivity by curling from the device (if curl available) or opening app that
makes HTTP calls. To remove:
adb reverse --remove tcp:8080
adb shell settings delete global http_proxy
When using adb reverse, you do not need to expose Burp to the network —
safer in classroom setups.
Option D — Start emulator with proxy
(alternate)
You can start emulator with the HTTP proxy pre-configured:
emulator -avd <AVD_NAME> -http-proxy [Link]
or from an already running emulator:
adb shell settings put global http_proxy [Link]:8080
Making Burp/ZAP accept connections
from device
● If you use host IP (Option A with real device), configure Burp listener to All
interfaces ([Link]) or add a listener with your host IP.
● If you use adb reverse (Option C), leave Burp listening only on [Link] — that’s
fine.
In Burp: Proxy → Options → Add a listener (bind to [Link]:8080 if needed).
In ZAP: Tools → Options → Local proxies → ensure the address/port is correct.
HTTPS interception: install Burp/ZAP CA
certificate on device/emulator
If you want to intercept HTTPS responses without TLS errors, install the proxy CA on the
device:
1. Export CA from Burp: Proxy → Options → Certificate → Export → DER format (e.g.,
[Link]) and rename to .crt.
2. Push to device and install (on emulator or rooted device this is easiest):
adb push [Link] /sdcard/
# On emulator: Settings -> Security -> Install from SD card -> choose
[Link]
# OR (system install, requires root/writable system):
adb root
adb remount
adb push [Link] /system/etc/security/cacerts/<random>.0
adb shell 'chmod 644 /system/etc/security/cacerts/<random>.0'
adb reboot
If you used adb reverse and proxy to [Link], still install CA as above.
Reminder: Android 7+ by default does not trust user-added CAs for apps unless
the app's network_security_config allows it or the CA is installed into the
system store. For lab use, prefer an emulator API 23 image or install the CA into
the system store (requires root/emulator). Alternatively, use debug/build variants of
your test app that allow user CAs.
Quick troubleshooting checklist
● No traffic in Burp:
○ Confirm adb shell settings get global http_proxy returns the
expected value.
○ Confirm Burp is listening on the expected IP/port.
○ For emulator: try adb shell ping [Link] or adb shell curl
[Link] (some images lack curl).
○ If physical device and using host IP, ensure both device and host are on same
network and firewall allows traffic.
○ If using adb reverse, confirm adb reverse --list shows mapping.
● TLS errors / app refuses connection:
○ App may reject user CAs (Android 7+). Use emulator API <=23 or install CA into
system store.
○ Alternatively, build a debug version of the app that allows user CAs (add
network_security_config for debug).
● Proxy setting not applied:
○ Some devices/manufacturers override global settings. Try the explicit
global_http_proxy_host/port keys (Option B).
● Persistent proxy after tests:
○ Always clear with adb shell settings delete global http_proxy and
remove global_http_proxy_* keys.
One-page commands cheat-sheet
(copy-paste)
# ===== set simple proxy to host (emulator) =====
adb shell settings put global http_proxy [Link]:8080
adb shell settings get global http_proxy
# ===== explicit host/port keys =====
adb shell settings put global global_http_proxy_host [Link]
adb shell settings put global global_http_proxy_port 8080
adb shell settings get global global_http_proxy_host
adb shell settings get global global_http_proxy_port
# ===== use adb reverse (map device:8080 -> host:8080) =====
adb reverse tcp:8080 tcp:8080
adb shell settings put global http_proxy [Link]:8080
# ===== remove proxy =====
adb shell settings delete global http_proxy
adb shell settings delete global global_http_proxy_host
adb shell settings delete global global_http_proxy_port
adb shell settings delete global global_http_proxy_exclusion_list
# ===== check reverse mappings =====
adb reverse --list
Recommended class flow (hands-on)
1. Instructor: start Burp (localhost:8080). Export CA.
2. Instructor: run adb reverse tcp:8080 tcp:8080. Set device proxy -> adb shell
settings put global http_proxy [Link]:8080. Install CA (emulator
system store) if needed.
3. Students: run the vulnerable app and watch Burp intercept.
4. Clean up: instructor runs the delete/adb reverse remove commands.