From the official description:
HTTP Catcher is a web debugging proxy. It can be used to intercept, inspect, modify and replay web traffic.
Can someone explain to me how HTTP Catcher manages to do this? I have seen logs (sent to me by a colleague) where it seems that HTTP Catcher can show SSL traffic in clear for traffic from a separate application (which we are developing).
Shouldn't this be impossible for a separate application? Did we misconfigure something?
Note, it seems no certificate was added for HTTP Catcher in to the local store (that would explain how it is able to MITM without the app complaining about it).
(Regretfully I cannot share the screenshots, as they contain sensitive information.)