intercepting-mobile-traffic-with-burpsuite skill (Anthropic-Cybersecurity-Skills)

From Public Agent Wiki

What it does. 'Intercepts and analyzes HTTP/HTTPS traffic from mobile applications Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).
Upstream mukul975/Anthropic-Cybersecurity-Skills
Skill file skills/intercepting-mobile-traffic-with-burpsuite/SKILL.md
License Apache-2.0 (skill folder LICENSE)
Author mukul975
Fetched 2026-09-10

Install

  • npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill intercepting-mobile-traffic-with-burpsuite, or copy the skill folder into ~/.claude/skills/intercepting-mobile-traffic-with-burpsuite/.
  • Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/intercepting-mobile-traffic-with-burpsuite/SKILL.md

SKILL.md (verbatim)

name: intercepting-mobile-traffic-with-burpsuite
description: 'Intercepts and analyzes HTTP/HTTPS traffic from mobile applications
  using Burp Suite proxy to identify insecure API communications, authentication flaws,
  data leakage, and server-side vulnerabilities. Use when performing mobile application
  penetration testing, assessing API security, or evaluating client-server communication
  patterns. Activates for requests involving mobile traffic interception, Burp Suite
  mobile proxy, API security testing, or mobile HTTPS analysis.

  '
domain: cybersecurity
subdomain: mobile-security
author: mahipal
tags:
- mobile-security
- android
- ios
- burp-suite
- traffic-interception
- penetration-testing
version: 1.0.0
license: Apache-2.0
nist_csf:
- PR.PS-01
- PR.AA-05
- ID.RA-01
- DE.CM-09
mitre_attack:
- T1059
- T1056
- T1036
- T1078

Intercepting Mobile Traffic with Burp Suite

When to Use

Use this skill when:

  • Testing mobile application API endpoints for authentication, authorization, and injection vulnerabilities
  • Analyzing data transmitted between mobile apps and backend servers during penetration tests
  • Evaluating certificate pinning implementations and their bypass difficulty
  • Identifying sensitive data leakage in mobile network traffic

Do not use this skill to intercept traffic from applications you are not authorized to test -- traffic interception without authorization violates computer fraud laws.

Prerequisites

  • Burp Suite Professional or Community Edition installed on testing workstation
  • Android device/emulator or iOS device on the same network as Burp Suite host
  • Burp Suite CA certificate installed on the target device
  • For Android 7+: Network security config modification or Magisk module for system CA trust
  • For SSL pinning bypass: Frida + Objection or custom Frida scripts
  • Wi-Fi network where proxy configuration is possible

Workflow

Step 1: Configure Burp Suite Proxy Listener

Burp Suite > Proxy > Options > Proxy Listeners:
- Bind to address: All interfaces (or specific IP)
- Bind to port: 8080
- Enable "Support invisible proxying"

Verify the listener is active and note the workstation's IP address on the shared network.

Step 2: Configure Mobile Device Proxy

Android:

Settings > Wi-Fi > [Network] > Advanced > Manual Proxy
- Host: <burp_workstation_ip>
- Port: 8080

iOS:

Settings > Wi-Fi > [Network] > Configure Proxy > Manual
- Server: <burp_workstation_ip>
- Port: 8080

Step 3: Install Burp Suite CA Certificate

Android (below API 24):

# Export Burp CA from Proxy > Options > Import/Export CA Certificate
# Transfer to device and install via Settings > Security > Install from storage

Android (API 24+ / Android 7+): Apps targeting API 24+ do not trust user-installed CAs by default. Options:

# Option A: Modify app's network_security_config.xml (requires APK rebuild)
# Add to res/xml/network_security_config.xml:
# <network-security-config>
#   <debug-overrides>
#     <trust-anchors>
#       <certificates src="user" />
#     </trust-anchors>
#   </debug-overrides>
# </network-security-config>

# Option B: Install as system CA (rooted device)
openssl x509 -inform DER -in burp-ca.der -out burp-ca.pem
HASH=$(openssl x509 -inform PEM -subject_hash_old -in burp-ca.pem | head -1)
cp burp-ca.pem "$HASH.0"
adb push "$HASH.0" /system/etc/security/cacerts/
adb shell chmod 644 /system/etc/security/cacerts/$HASH.0

# Option C: Magisk module (MagiskTrustUserCerts)

iOS:

1. Navigate to http://<burp_ip>:8080 in Safari
2. Download Burp CA certificate
3. Settings > General > VPN & Device Management > Install profile
4. Settings > General > About > Certificate Trust Settings > Enable full trust

Step 4: Intercept and Analyze Traffic

With proxy configured, open the target app and navigate through its functionality:

Burp Suite > Proxy > HTTP History: Review all captured requests and responses.

Key areas to analyze:

  • Authentication tokens: JWT structure, token expiration, refresh mechanisms
  • API endpoints: RESTful paths, GraphQL queries, parameter patterns
  • Sensitive data in transit: PII, credentials, financial data
  • Response headers: Security headers (HSTS, CSP, X-Frame-Options)
  • Error responses: Stack traces, debug information, internal paths

Step 5: Test API Vulnerabilities Using Burp Repeater

Forward intercepted requests to Repeater for manual testing:

Right-click request > Send to Repeater

Test categories:
- Authentication bypass: Remove/modify auth tokens
- IDOR: Modify user IDs, object references
- Injection: SQL injection, NoSQL injection in parameters
- Rate limiting: Rapid request replay for brute force assessment
- Business logic: Modify prices, quantities, permissions in requests

Step 6: Automate Testing with Burp Scanner

Right-click request > Do active scan (Professional only)

Scanner checks:
- SQL injection (error-based, blind, time-based)
- XSS (reflected, stored)
- Command injection
- Path traversal
- XML/JSON injection
- Authentication flaws

Step 7: Handle Certificate Pinning

If traffic is not visible due to certificate pinning:

# Frida-based bypass (generic)
frida -U -f com.target.app -l ssl-pinning-bypass.js

# Objection bypass
objection --gadget com.target.app explore
ios sslpinning disable  # or
android sslpinning disable

Key Concepts

Term Definition
MITM Proxy Man-in-the-middle proxy that terminates and re-establishes TLS connections to inspect encrypted traffic
Certificate Pinning Client-side validation that restricts accepted server certificates beyond the OS trust store
Network Security Config Android XML configuration controlling app trust anchors, cleartext traffic policy, and certificate pinning
Invisible Proxying Burp feature handling non-proxy-aware clients that don't send CONNECT requests
IDOR Insecure Direct Object Reference -- accessing resources by manipulating identifiers without authorization checks

Tools & Systems

  • Burp Suite Professional: Full-featured web application security testing proxy with active scanner
  • Burp Suite Community: Free version with manual interception and basic tools
  • Frida: Dynamic instrumentation for runtime SSL pinning bypass
  • mitmproxy: Open-source alternative to Burp Suite for programmatic traffic analysis
  • Charles Proxy: Alternative HTTP proxy with mobile-friendly certificate installation

Common Pitfalls

  • Android 7+ CA trust: User-installed certificates are not trusted by apps targeting API 24+. Must use system CA installation or app modification.
  • Certificate transparency: Some apps use Certificate Transparency logs to detect MITM. Check for CT enforcement in the app.
  • Non-HTTP protocols: Burp Suite only handles HTTP/HTTPS. Use Wireshark for WebSocket, MQTT, gRPC, or custom binary protocols.
  • VPN-based apps: Apps using VPN tunnels bypass device proxy settings. May need iptables rules on a rooted device to redirect traffic.

Other files in this skill

assets/template.md (verbatim)

Mobile Traffic Interception Assessment Report

Engagement Information

Field Value
Application [APP_NAME]
Platform [Android/iOS]
Proxy Tool Burp Suite [VERSION]
Assessment Date [DATE]
Total Requests Captured [COUNT]
Unique Endpoints [COUNT]

API Surface Map

Method Endpoint Auth Required Description
[METHOD] [PATH] [YES/NO] [DESCRIPTION]

Traffic Security Findings

Finding [N]: [TITLE]

  • Severity: [CRITICAL/HIGH/MEDIUM/LOW]
  • OWASP Mobile: [M1-M10]
  • CWE: [CWE-ID]
  • Affected Endpoint: [URL]
  • Description: [DESCRIPTION]
  • Evidence: [REQUEST/RESPONSE_SNIPPET]
  • Recommendation: [REMEDIATION]

Authentication Analysis

Check Result Details
Token Format [JWT/Opaque/Other] [DETAILS]
Token Expiration [DURATION] [DETAILS]
Token in URL [YES/NO] [DETAILS]
Refresh Mechanism [Present/Absent] [DETAILS]
Session Invalidation [Works/Fails] [DETAILS]

Security Header Compliance

Header Present Value Status
Strict-Transport-Security [YES/NO] [VALUE] [PASS/FAIL]
Content-Security-Policy [YES/NO] [VALUE] [PASS/FAIL]
X-Content-Type-Options [YES/NO] [VALUE] [PASS/FAIL]
Cache-Control [YES/NO] [VALUE] [PASS/FAIL]

Recommendations

  1. [RECOMMENDATION]

references/api-reference.md (verbatim)

API Reference: Mobile Traffic Interception with Burp Suite

HAR (HTTP Archive) Format

Structure

{"log": {"entries": [{"request": {"method": "GET", "url": "https://...",
  "headers": [{"name": "Authorization", "value": "Bearer ..."}],
  "postData": {"text": "..."}},
  "response": {"status": 200, "headers": [...],
  "content": {"text": "..."}}}]}}

Key HAR Fields

Field Description
request.url Full request URL
request.method HTTP method
request.headers Request headers array
request.postData.text POST body content
response.status HTTP status code
response.content.text Response body

Burp Suite Proxy Setup for Mobile

  1. Set proxy listener: 127.0.0.1:8080
  2. Configure device WiFi proxy to Burp IP:8080
  3. Install Burp CA: http://burp/cert
  4. Export traffic as HAR: Proxy > HTTP History > Save Items

mitmproxy Alternative

mitmproxy --mode regular --listen-port 8080
mitmdump -w output.flow --set flow_detail=3
# Convert to HAR:
mitmproxy2har output.flow > capture.har

Certificate Pinning Bypass

Platform Tool
Android Frida + objection (objection explore --startup-command 'android sslpinning disable')
iOS SSL Kill Switch 2 (Cydia)

Sensitive Data Patterns

Type Regex Pattern
Email [a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}
Credit Card `\b(?:4\d{3}
JWT eyJ[a-zA-Z0-9_-]+\.eyJ[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+

References

references/standards.md (verbatim)

Standards Reference: Mobile Traffic Interception with Burp Suite

OWASP Mobile Top 10 2024 Mapping

OWASP ID Risk Burp Suite Testing Coverage
M1 Improper Credential Usage Identify credentials in plaintext, weak token formats in API traffic
M3 Insecure Authentication/Authorization Test auth bypass, session management, IDOR via request manipulation
M4 Insufficient Input/Output Validation SQL injection, XSS, command injection via Burp Scanner/Repeater
M5 Insecure Communication Detect cleartext HTTP, weak TLS, missing HSTS, certificate validation
M8 Security Misconfiguration Identify verbose error messages, debug endpoints, missing security headers

OWASP MASVS v2.0 Control Mapping

MASVS Category Burp Suite Assessment Test Method
MASVS-NETWORK TLS configuration, certificate pinning, cleartext detection Proxy interception, SSL scan
MASVS-AUTH Token validation, session handling, credential transmission Repeater manipulation
MASVS-STORAGE Sensitive data in API responses cached client-side Response header analysis
MASVS-PLATFORM Deep link parameter injection, WebView URL loading Request crafting

OWASP API Security Top 10 2023

API Risk Burp Suite Test
API1: Broken Object Level Authorization Modify object IDs in intercepted requests
API2: Broken Authentication Replay tokens, test token expiration
API3: Broken Object Property Level Auth Modify response/request properties
API5: Broken Function Level Authorization Access admin endpoints with user tokens
API8: Security Misconfiguration Check response headers, error handling

CWE Mappings

CWE ID Title Detection Method
CWE-200 Exposure of Sensitive Information Inspect API responses for data leakage
CWE-295 Improper Certificate Validation Test with self-signed proxy certificate
CWE-319 Cleartext Transmission Monitor for HTTP (non-HTTPS) requests
CWE-352 Cross-Site Request Forgery Check for anti-CSRF tokens in requests
CWE-613 Insufficient Session Expiration Test token validity after logout

references/workflows.md (verbatim)

Workflows: Mobile Traffic Interception with Burp Suite

Workflow 1: Standard Mobile API Testing

[Configure Burp Listener] --> [Set Device Proxy] --> [Install CA Cert] --> [Open Target App]
                                                                                |
                                                                                v
                                                                     [Capture HTTP History]
                                                                                |
                                                          +---------------------+---------------------+
                                                          |                     |                     |
                                                   [Map API surface]    [Identify auth flow]   [Check data exposure]
                                                          |                     |                     |
                                                          v                     v                     v
                                                   [Send to Scanner]    [Token analysis]       [PII in responses]
                                                   [Active scan]        [Session testing]      [Sensitive headers]
                                                          |                     |                     |
                                                          +---------------------+---------------------+
                                                                                |
                                                                         [Compile findings]
                                                                         [Generate report]

Workflow 2: SSL Pinning Bypass Pipeline

[Set Proxy] --> [Open App] --> [Connection fails?]
                                    |
                              [Yes: Pinning active]
                                    |
                     +--------------+--------------+
                     |              |              |
              [Frida bypass]  [Objection]   [APK repackage]
              [Generic script] [sslpinning] [Remove pinning code]
                     |         [disable]          |
                     +--------------+--------------+
                                    |
                           [Verify traffic flows]
                           [Continue assessment]

Workflow 3: Authentication Testing

[Intercept login request] --> [Capture auth token] --> [Analyze token format]
                                                              |
                                                   +----------+----------+
                                                   |                     |
                                            [JWT analysis]        [Opaque token]
                                            [Decode payload]      [Session management]
                                            [Check signature]     [Timeout testing]
                                            [Modify claims]       [Concurrent session]
                                                   |                     |
                                                   +----------+----------+
                                                              |
                                                    [Test IDOR with user IDs]
                                                    [Test privilege escalation]
                                                    [Test token replay after logout]

Decision Matrix: Traffic Interception Approach

Scenario Android iOS
No pinning, API < 24 Standard proxy + user CA Standard proxy + profile install
No pinning, API 24+ System CA or network_security_config mod Standard proxy + profile install
Pinning implemented Frida/Objection bypass + system CA Frida/Objection bypass
Custom protocol Wireshark + custom Frida hooks Wireshark + custom Frida hooks
VPN tunnel iptables redirect on rooted device Not feasible without jailbreak

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.