How to Proxy and Inspect Mobile App Traffic with Burp Suite

Summary

The tutorial configures Burp Suite to intercept a demo banking app’s traffic, then modifies a password-change request to bypass the app’s complexity check and change the password for another username.

Key points

• The presenter configures a Burp Suite proxy listener and exports a CA certificate for installation on the mobile device.
• The device’s Wi-Fi proxy is set to route app traffic through Burp Suite, where login requests and submitted credentials are visible.
• The presenter sends a password-change request to Repeater and modifies it after the app rejects a simple password.
• Changing the request’s username to Jack and using a simple password returns a successful password-change response; the presenter then logs in as Jack in the demo app.
• The demonstration shows how client-side password checks and trusting modifiable request fields can expose account security; it does not establish a real-world incident.