- Installation
- Download ZAP from here.
- Install and open ZAP
- Installing certificate
Since all requests and responses are proxied by ZAP, the certificate verification will fail for sites using SSL (HTTPS) and the connection will be terminated. To prevent this from happening, ZAP generates an SSL certificate for each host, signed by its own Certificate Authority (CA) certificate. This CA certificate is generated the first time ZAP is run, and is stored locally. To use the ZAP Proxy with these websites, you will need to install ZAP’s CA certificate as a trusted root for your device.
- Go to Tools>Options>Dynamic SSL Certificate. Click Generate and then click Save.
- Save the certificate in the desired location. Make sure the file has a .cer extension
- Send the certificate to the android device (This could be done via email)
- Upon receiving the certificate, click on it to open the certificate.
- Give the certificate a suitable name. For credential use, select “VPN and apps”. Click OK.
- Configuring Proxy
- Connect your laptop/PC to a known Wifi network (A dedicated router works best.)
- In the ZAP UI, go to Tools>Options>Local Proxy
- Set Address as Blank
- Set port number to a port of your choosing (preferably 8080)
- Find out the IP address of your laptop/PC (Type ipconfig in the command line for windows, ifconfig in terminal for mac/linux)
- On your Android device go to Settings>Wifi
- Connect to the same network as your laptop/PC.
- Touch and hold the wifi network.
- Select modify network.
- Tick the checkbox “Show advanced options”
- Set the Proxy to Manual
- Type the laptop/PC’s IP address in Server field, and the port number as selected earlier (8080). Leave the rest of the settings as default.
- Click Save.
- Open any SSL website in your android browser and make sure the site shows up below Sites list in ZAP
