however, nowadays there are "protections" that mobile apps can use to prevent others from studying their traffic. for better or for worse, attackers also created countermeasures to these protections: frida, etc.
guides / tutorials are plenty on the net. if it's not just for fun, you should probably hire a professional to help you. or get proper (paid) training on using those tools i mentioned.
Testing / Finding backdoor of a product without proper invitation / authorized may have legal issue.