In the story, BurpSuite was used only on the attacker's machine for ease of use. You could also hand-craft the requests using curl. Cert pinning doesn't help

In the story, BurpSuite was used only on the attacker's machine for ease of use. You could also hand-craft the requests using curl. Cert pinning doesn't help when someone installs their own certificate authority. It stops other CAs that came bundled with the browser from working, but if it stopped self-installed certificates from working it never would have gotten off the ground because many organizations demand the ability to use their own certificates for signing things.