My Application has a ssl Certification. But when i intercept the app with a tool, am able to see the sensitive information in a plain text. How can it happen? Will the Tool Breaks the SSL connection between the browser and the server? or any other Man in Middle attacks are happening here?
Check the certificate shown in your browser when you are accessing your application. You should see that it claims to be from a company called Portswigger who are the manufacturers of Burp.
What is happening is that your browser, proxies through Burp, is picking up that certificate, and encrypting traffic with it. Burp can decrypt that traffic, and display it. It also reencrypts the traffic with the original server certificate and sends it to the server for processing.
The same happens in reverse for responses. It is effectively a man in the middle attack, but one that you are running against yourself.
There are ways to protect against this, but they aren't always appropriate for web applications due to browser support issues.