It all depends on the application itself and what kind of security measures are implemented. Assuming requests are sent over HTTP(s), then the easiest way is to use a proxy such as Burp. You will need to install a CA certificate on your mobile device. You'll be able to see requests & responses in the proxy software (Burp).
APP <----> proxy <----> server
If the application is using SSL/TLS pinning, then the above solution will not work out of the box. Some function(s) will perform additional checks on the certificate, you will need to tamper such function(s) in order to bypass it. Generally there are two ways:
- Patch the application in order to remove the SSL/TLS pinning. This usually requires unpacking, editing, repacking and resigning the app. Quite tiresome if you ask me.
- Hook the SSL/TLS pinning logic and disable such logic. Frida is a pretty cool tool for this (multi platform), Substrate on iOS and xposed on Android.
A second solution is to not use a proxy at all! Usually an HTTP client library is being used to perform such requests. You can hook HTTP request functions and print the content directly.
APP <----> server
^-> hooked functions which prints the requests
The second solution can be useful when the app is not using standard HTTP requests. Some apps use binary protocols such a gRPC, it would be easier to hook the
myclient_post(jsonData) function and print the parameters + response, than reverse engineer the binary protocol, setup a proxy etc...
Some links which might be useful: