android:allowBackup the default value of this attribute is true

adb backup -f backup.ab app.package.name

Use Android backup extractor (abe) to extract and repack android backups.

abe unpack backup.ab backup.tar
https://developer.android.com/guide/topics/manifest/application-element.html#allowbackup
https://github.com/nelenkov/android-backup-extractor

Download the .apk through the Inspeckage.Download -> APK

Use Google Enjarify tool for translating Dalvik bytecode to equivalent Java bytecode.

enjarify yourapp.apk -o yourapp.jar

Use JD-GUI to decompile and analyze Java bytecode.

java -jar jd-gui.jar
https://github.com/google/enjarify
http://jd.benow.ca/

With monkeyrunner, you can write a Python program that run an automated start-to-finish test of an Android application. You provide input values with keystrokes or touch events, and view the results as screenshots.

Exemplo: Go to android-sdk-path/tools/ where the monkeyrunner program there is and save in a file startfox.py:

from com.android.monkeyrunner import MonkeyRunner, MonkeyDevice
import commands
import sys

# starting script
print "start"

# connection to the current device
device = MonkeyRunner.waitForConnection()

print "launching firefox: Package=org.mozilla.firefox and Main Activity=org.mozilla.gecko.BrowserApp"
device.startActivity(component='org.mozilla.firefox/org.mozilla.gecko.BrowserApp')

#wait
MonkeyRunner.sleep(3)

print "end of script"

Now, run: monkeyrunner startfox.py and the firefox is launched.

https://developer.android.com/studio/test/monkeyrunner/index.html

1 - Connect both your device and your computer to the same wireless network;

2 - Choose your favorite http proxy tool and set up a new proxy listenner -- eg. listener address: 192.168.25.22 (computer ip) and port: 8001 (port number that is not currently in use);

3 - Go to Inspeckage (Settings -> Add Proxy) and set up the same address (192.168.25.22) and port (8001) of your proxy tool;

4 - Now, open the app (in a feature that makes http request) and the request should be intercepted in your proxy tool.

OWASP ZAP
Burp Suite Free Edition
Fiddler

If the app use HTTPS, you need install the proxy tool certificate in your device.

https://developer.android.com/training/articles/security-ssl.html
OWASP ZAP allows you to transparently decrypt SSL connections.

If the app use HTTPS and certificate pinning, you need install the proxy tool certificate in your device and bypass the pinning.

The Inspeckage can disable pinning for some libraries. Settings->SSL uncheck [ON]