Lion Cipher Lab

Intercept and Inspect an Android App's Network Traffic (Dynamic Analysis)

• AppSec / DevSecOps
• Intermediate
• ~90 min
• Free · no account required

Why it matters

A mobile app is mostly a friendly front-end to an API -- a set of web calls to a backend server -- so a huge share of a mobile app's real risk lives not in the code on the phone but on the WIRE between the phone and the server: the credentials it sends, the tokens that prove who you are, the data it uploads, and whether any of it is protected in transit. Static analysis (reading the app package and code at rest, the way the MobSF and MASTG labs do) cannot see that conversation, because it only happens when the app is RUNNING against its backend. Dynamic analysis can. The everyday tool for it…

What you'll learn

• the difference between STATIC analysis (inspecting the app at rest) and DYNAMIC analysis (watching the app run and talk to its backend)
• what an intercepting proxy is and how it sits between a mobile app and its API server
• standing up an intercepting proxy (Burp Suite or mitmproxy) as an HTTPS interceptor on a machine you own
• routing an Android emulator's traffic through the proxy
• why HTTPS traffic is unreadable until you install the proxy's CA certificate, and installing it as a trusted CA on your own emulator
• why modern Android ignores user-added CAs and why a testing emulator is needed to trust the proxy at the system level
• reading a mobile app's real API calls: endpoints, headers, auth tokens, and request/response bodies
• spotting sensitive data in transit and weak transport (cleartext HTTP, no TLS) on the wire
• understanding certificate pinning: what it is, what it prevents, and how you recognise a pinned app in your proxy
• mapping findings to OWASP MASVS-NETWORK and connecting mobile testing to API security

Steps in this lab

1. What this is, static vs dynamic, and the one rule that keeps it legal
2. The four words you need: API, proxy, TLS/HTTPS, and certificate pinning
3. Stand up your target: an emulator you own and the vulnerable app (plus its backend)
4. Start the intercepting proxy (Burp OR mitmproxy)
5. Route the emulator through the proxy, then install the proxy's CA so HTTPS becomes readable
6. Read the app's real API calls: sensitive data in transit and weak transport
7. Meet certificate pinning: the wall, what it prevents, and how to recognise it
8. Write it up, tie mobile to API security, clean up, and where this goes next

Open the full interactive lab →