Intercepting them with BURP/ZAP/Fiddler or any other HTTP proxy will Over SSL? The communication protocol is not necessarily HTTP/S so What is the best way to analyze requests sent by a mobile application (we are not intending to implement a login mechanism) My organization is considering implementing a messaging application that works in a similar way and we are trying to make sure that a malicious user cannot steal the identity of a legitimate user. what mechanism do they have in place to prevent a malicious user to fetch the chat history of a legitimate user (seeing as there is no actual login - Is there a cookie/another mechanism sent from the device identifying the user in front of the server?)

I am specifically interested in understanding how the Whatsapp security model works - i.e. If the application uses certificate pinning, is there still a way to do this? I've read some material here relating to similar subjects but I couldn't find description of a complete flow I could follow to actually perform this task.ĭoes the device on which the application is installed need to be rooted for me to perform this task? How do I get the traffic to even reach the proxy? The communication protocol is not necessarily HTTP/S so intercepting them with BURP/ZAP/Fiddler or any other HTTP proxy will not necessarily work, but. What is the best way to analyze requests sent by a mobile application over SSL?

Analyzing https wireshark