Intercept all HTTP + SSL Android traffic and bypass SSL Pinning

How to intercept all Android HTTP / HTTPS network traffic on Windows and bypass SSL Pinning

1.  Install ADB / Android SDK or use the AppUse VM
2. Root the android device
3. Install Android Cydia Substrate

adb install com.saurik.substrate.apk

4. Install Android SSL Trust Killer

adb install Android-SSL-TrustKiller.apk

5. Export Burp Root CA Certificate
6. Push Burp Cert to the sdcard

adb push PortSwiggerCA.cer /sdcard

7. Install Burp Cert in the Android Trust Store

Settings > Security > Install from device storage

8. On Windows, create a Wireless hotspot sharing your Internet / external connection
1. Create the hotspot:

​netsh wlan set hostednetwork mode=allow ssid=MyHotspot key=MyPassword keyUsage=persistent

2. To start the hotspot

netsh wlan start hostednetwork

3. Or to stop the hotspot:

netsh wlan stop hostednetwork

9. Enabled Internet Connection Sharing with your external connection:

Right click your connection's NIC, "Sharing" tab, check the box, select "MyHotspot". The external NIC icon should say "shared".

10. Connect the Android to the wifi Hotspot using the key configured previously.
11. Optional: If you prefer to use a static network configuration as opposed to DHCP, go to the Wifi connection advanced settings and look for the IP address attributed. Switch to a static IP and set this IP manually. The gateway should be the IP address of the Windows "MyHotspot" interface. The DNS Server should be your ISP's / corporate network one. Reconnect the Wifi with the new network configuration.
12. Try to ping the Android device's IP address from the Windows.
13. Run Burp and make it listen on the Hotspot's interface IP address.
14. You can configure this proxy in the Wireless connection advanced settings, but that would take effect only for proxy-aware apps such as the web browser. Preferably, and since your device is rooted, use an app such as ProxyDroid to make all the apps go through the proxy transparently. You should have Play Store working as well.
15. Configure your Burp's upstream proxies rules if needed.
16. You should be able to intercept all HTTP/HTTPS traffic. If not, well, go back to step 1.