July 23, 2026

By Yasser Ali, Meta Bug Bounty

Mobile security research has historically been frustrating. Between SSL pinning, certificate headaches, and opaque network stacks, many researchers have avoided mobile testing altogether. In our latest researcher survey, streamlining mobile traffic interception was the #1 requested improvement.

With the new Whitehat Settings feature (SSL Pinning Bypass toggle), setting up a mobile security research environment is now dramatically simpler than it used to be. This post walks you through setting up Burp Suite, a popular web security testing tool used to intercept and analyze HTTP/HTTPS traffic, to intercept traffic from Meta's mobile apps, Facebook, Instagram, Messenger, and Threads.

Whether you're a seasoned mobile researcher or someone who has avoided mobile testing because the setup felt daunting, this guide is for you.

Mobile security and privacy researchers intercept network traffic from apps and devices to understand what data is being sent, to whom, and under what conditions, especially when the app's behavior isn't fully observable from the UI or logs. This foundational step in mobile security research has historically been cumbersome.

A proxy sits between your mobile device and the internet, allowing you to see, modify, and replay every HTTP/HTTPS request the app makes. For security testing, this visibility is essential.

SSL pinning is a security measure that prevents man-in-the-middle interception by hardcoding which certificates an app trusts. While great for user security, it made legitimate research extremely difficult. Researchers previously had to use Frida scripts or rely on unstable workarounds.

Meta's Whitehat Settings now let you toggle SSL pinning bypass directly inside the app. Just flip a switch and start intercepting.

Your phone needs to reach Burp over the network, so binding to localhost alone will not work.

macOS:

ifconfig | grep "inet " | grep -v 127.0.0.1

Windows:

ipconfig

Linux:

ip addr show | grep "inet "

Make sure both your computer and phone are connected to the same Wi-Fi network.

You can follow the instructions in https://portswigger.net/burp/documentation/desktop/mobile

Alternatively, you can set the proxy via ADB:

adb shell settings put global http_proxy <your-machine-ip>:<your-machine-port>

Installing Burp's CA Certificate:

Note on Android 7+: User-installed CA certificates are not trusted by apps by default on Android 7 and above. This is exactly where Whitehat Settings comes in, as it bypasses this restriction for Meta apps.

Installing Burp's CA Certificate:

This is the feature that makes everything click. Instead of fighting SSL pinning, you simply ask the app to let you through.

Time to confirm everything works:

If you notice that the HTTP request/response body looks like garbled binary data (like the screenshot below), that is gzip compression.

Burp offers auto-decompression so you don't have to do it manually each time. Navigate to your proxy settings and check the "Unpack compressed requests/responses".

When dealing with HTTP requests you want to modify, they usually appear in application/x-www-form-urlencoded format.

It is much easier to just convert the encoding by right-clicking in the repeater tab then change the body encoding to multipart which makes it easier to view and modify.

Alternatively, use the Inspector by selecting the full encoded text instead of trying to modify it manually.

The most important parts of any GraphQL request are the doc_id (or client_doc_id) and the variables. Without them, the server cannot determine what action the user is trying to perform. Every operation has a unique doc_id, so changing it will call a completely different action. The variables contain the parameters for that action, like user IDs, content references, and input values.

Refer to the most up-to-date payout guidelines on bugbounty.meta.com for the latest qualifying vulnerabilities and reward ranges.

With Whitehat Settings and a basic Burp Suite setup, mobile security research on Meta apps is now genuinely accessible. What used to take hours of reverse engineering and fragile tooling now takes about 15 minutes of straightforward configuration. If you have been avoiding mobile research because the barrier to entry felt too high, now is the time to give it a shot. And if you are already comfortable with mobile testing, the new pinning bypass should make your workflow significantly smoother.

Found something interesting? Submit it through our Bug Bounty program . We are excited to see what you find.

Happy hunting!