skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

intercepting-mobile-traffic-with-burpsuite

Intercepts and analyzes mobile app HTTP/HTTPS traffic using Burp Suite proxy.

954|172|Updated Mar 13, 2026
Search Tags:#penetration testing#mobile security#api security#traffic interception#burp suite#ssl pinning#MITM proxy
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill intercepting-mobile-traffic-with-burpsuite
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: intercepting-mobile-traffic-with-burpsuite
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/mobile-security/intercepting-mobile-traffic-with-burpsuite
Command: npx skills add https://github.com/xalgord/xalgorix --skill intercepting-mobile-traffic-with-burpsuite

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Mobile applications communicate with backend APIs over encrypted channels, making it difficult for security testers to inspect requests, detect authentication flaws, and identify data leakage without a structured interception workflow.

Core Features & Use Cases

  • Proxy Configuration: Step-by-step setup of Burp Suite listeners and Android/iOS device proxy settings, including CA certificate installation for Android 7+ system trust and iOS full trust.
  • Traffic Analysis: Guides inspection of authentication tokens, API endpoints, sensitive data in transit, and security headers through Burp's HTTP history.
  • Vulnerability Testing: Uses Burp Repeater and Scanner to test for IDOR, injection, authentication bypass, and business logic flaws, with Frida/Objection workflows for certificate pinning bypass.
  • Use Case: During a mobile app penetration test, configure an Android emulator to route traffic through Burp Suite, bypass SSL pinning with Objection, and replay API requests in Repeater to test for IDOR vulnerabilities.

Quick Start

Set up Burp Suite to intercept traffic from my Android test device and walk me through analyzing the app's API requests for security issues.

Frequently Asked Questions about intercepting-mobile-traffic-with-burpsuite

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I intercept mobile app traffic with Burp Suite?▼

Configure a Burp proxy listener on port 8080 bound to all interfaces, set the mobile device's Wi-Fi proxy to the workstation IP, and install the Burp CA certificate on the device. Then open the app and review captured requests in Burp's HTTP history.

Why can't I see app traffic in Burp Suite on Android 7 or later?▼

Apps targeting API 24+ do not trust user-installed CA certificates by default. Install the Burp CA as a system certificate on a rooted device, use a Magisk module, or modify the app's network_security_config.xml to trust user CAs.

How do I bypass SSL certificate pinning on Android or iOS?▼

Use Frida with a generic SSL pinning bypass script or Objection's built-in commands (android sslpinning disable or ios sslpinning disable). If requests reappear after the bypass, pinning was the cause rather than proxy misconfiguration.

Does Burp Suite capture WebSocket, gRPC, or MQTT traffic?▼

Burp Suite only handles HTTP/HTTPS traffic and will not show WebSocket, gRPC, MQTT, or custom binary protocols. Use Wireshark to confirm and analyze traffic on those non-HTTP channels.

What is the difference between Burp Suite Professional and Community for mobile testing?▼

Both versions support manual interception and Repeater-based testing, but only Professional includes the active Scanner for automated detection of SQL injection, XSS, command injection, and authentication flaws.

Why does a VPN-based app bypass the device proxy settings?▼

Apps routing traffic through VPN tunnels ignore device-level proxy configuration, so no requests reach Burp. On a rooted device, use iptables rules to redirect the traffic to the Burp listener instead.

Related Skills

Explore More Software Engineering Skills→
BuilderIOBuilderIO
11

android-native

Build and deploy Android APKs to emulators and devices using Gradle and adb.

Official
Intermediate
wgpsecwgpsec
1.6k

report-generate

Generate structured penetration testing reports with CVSS risk ratings and remediation guidance.

Official
Intermediate
GhostPWNGhostPWN
4

Mobile Application Security

Analyze Android and iOS apps for security weaknesses and malicious indicators.

Official
Advanced
0X6C78790X6C7879

protocol-reverse-engineering

Capture and analyze network traffic to document protocol structures.

Community
Advanced