Inspect the traffic.
Scope decryption to exactly the hosts you're testing, run block/mock/drop rules at the wire, and get an honest answer about what certificate pinning still hides from you.
Most MITM tools oversell
A tool that quietly fails to mention certificate pinning wastes a research session on a target it was never going to decrypt.
For security researchers and app testers auditing what an app or device actually sends — third-party SDKs, undocumented endpoints, whether an app degrades safely when a request is blocked or corrupted.
Busymate scopes decryption to a per-device SSL list you control, runs the same block/mock/drop rule engine at the wire on iOS, Android and the proxy, and logs every action — including direct database access — to an append-only audit trail. And it's upfront about the one thing it can't do: an app with its own certificate pinning won't decrypt through the SSL list, on any platform.
Scoped decryption,
Every claim below is checkable — nothing here is a black box.
Block, mock and drop at the wire
The same sandboxed rule engine runs inline on iOS, Android and the proxy — one rule set, enforced identically everywhere your target's traffic flows.
Every action, audited
An append-only audit trail records every action on every surface, including direct database access. Tail it live, filter it, or share a permalink to the exact event.
Honest about certificate pinning
An app pinning its own certificate won't decrypt through the SSL list on iOS, Android or the proxy — that's a real limit, not a bug. For traffic already inside a Chromium browser, the CDP-based capture (bmc) reads it post-decryption and is unaffected by pinning, because it never touches the TLS connection at all.
- Proxy
- iOS
- Android
- CLI
- Security & audit
From a target host to
With a real record at the end.
- 01
Scope the SSL list
Add only the hosts you're testing to the device or proxy's SSL list, and trust the generated CA on that device. Everything else passes through untouched.
- 02
Probe with rules
Write a block, mock or drop rule — or a sandboxed JS script — to see how the target behaves under a corrupted, delayed or missing response.
- 03
Tail the audit trail
Review exactly what changed and when — every rule you fired, every host decrypted — as a permalinkable, append-only record you can attach to a report.
How it works
Three moves, and a record of each one.
- 01
Scope decryption to the hosts you are testing
On the device or the proxy, add only the target's hosts to the SSL list and trust the generated certificate authority there. Everything outside that list stays end-to-end encrypted, so a session against one app never opens the rest of the phone's traffic.
- 02
Probe with rules and scripts
Write a block, mock or drop rule for a target endpoint, or a sandboxed JavaScript rule that rewrites a request or response on the way through. Watch how the app behaves when its backend answers slowly, wrongly, or not at all — the rule engine runs identically on iOS, Android and the proxy.
- 03
Take the record with you
Every rule you fired, every host you decrypted and every entry you inspected lands in the append-only audit trail. Filter it to the session, open the permalink to the exact event, and attach it to the report alongside the HAR export of the traffic itself.
Before you start a session,
Will it decrypt an app that pins its certificate?
No. Pinning defeats the SSL list on iOS, Android and the proxy — you see that the connection happened, not what was in it. Traffic already inside a Chromium browser is different: the browser capture reads it after Chrome has decrypted it, so pinning does not apply there.
Is capture limited to apps I own?
The tools work on whatever traffic reaches the device or proxy, and the terms require that you own the app or are authorized to test it. Capture is opt-in on every platform and can be stopped and removed at any time.
Where does the captured data go?
Decryption happens on the device or on your proxy. Entries you choose to sync are stored under your own account for the platform-wide retention window and can be deleted whenever you like; tokens and credentials can appear in bodies, so scope the SSL list narrowly.
Can I prove what I did during a session?
Yes. The audit trail is append-only and records every action on every surface — the dashboard, the API and AI agents alike. Each event has a permalink, so a finding can cite the exact moment a rule was applied.
Verify it yourself —
The security model is a page, not a claim — read exactly what's enforced where.