Burp Suite helps assess mobile back ends and HTTP traffic. Manage test certificates and client settings within an authorized laboratory.
Evaluation approach
Requests and responses observed through the proxy reveal session and authorization behavior. Prepare the device network and certificate trust in a controlled environment. Automated scanning and collaboration features differ between editions.
Application example
Compare requests for the same resource using two separate accounts in your test environment. Document which flows remain accessible with RASP enabled and in the comparison build; traffic volume alone is not a success measure.
Limits and considerations
Traffic hidden by certificate pinning or a custom network stack is not necessarily secure. A clean proxy result says nothing about local file or memory protection.
Controlled observation of mobile traffic
First confirm the device's network route with a simple endpoint you control. Trust settings and application pinning affect HTTPS inspection. Invisible traffic does not establish that an application is secure.
Recorded requests may contain tokens and personal data. Restrict project access and select only necessary examples for reports. Recording the server outcome of a modified request makes it possible to correlate that result with RASP events.
Checks and decisions
- Separate test accounts
- Exclude out-of-scope targets
- Verify authorization on the server
Choose Burp around the protocols you need, reproducible findings and team workflow. Keep RASP testing and API security testing as separate sections of the report.
Sources
The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.