Proxies like the one included in Burp Suite are designed for traffic interception. This allows the owner of the proxy to view, modify and drop packets passing through the proxy. While this can certainly be used for criminal purposes, it can also be used by cyberdefenders to protect against malware and dangerous user behavior.
In this article, we’ll discuss how to use Burp Suite to intercept Web traffic, both encrypted and unencrypted. We’ll start with unencrypted traffic (HTTP) and then cover the modifications necessary for HTTPS.
Any reasoning behind why it's a better alternative to Burp Community Edition? Also the repo states: The Guppy Proxy is an intercepting proxy for performing web application security testing. Its features are often similar to, or straight up rippoffs from Burp Suite. However, Burp Suite is expensive which makes a proxy like Guppy inevitable.
Intercepting HTTP Traffic
The first step to intercepting web traffic with Burp Suite is installing it on your system. The Burp Suite Community Edition is available from PortSwigger. After installing and opening Burp Suite, you’ll see a screen similar to the one below. [CLICK IMAGES TO ENLARGE]
When using Burp Suite as a proxy, it’s a good idea to ensure that the proxy is active. As shown in the screen above, this information is found under Proxy in the first row of tabs and Options in the second row. Note that the Burp proxy runs on 127.0.0.1:8080 by default.
Upgrade to the Pro version to checkout the vulnerability scanning capabilities of Burp Suite. If the price for Pro seems too steep then OWASP Zap is a free alternative to Burp that allows for. Nessus is the best alternative choice for burp suite. It is a popular vulnerability scanner software. It can scan a wide range of technologies including operating systems, databases, network devices, web servers, hypervisors, and critical infrastructures. The output of the scan can vary in various formats such as plain text, XML, Latex, and HTML.
If the proxy is running, the next step is setting up a Web browser to use the proxy. In this example, we’re using Chrome, so these settings can be found by opening Options and searching for Proxy as shown below.
- Burp Suite Package Description. Burp Suite is an integrated platform for performing security testing of web applications. Its various tools work seamlessly together to support the entire testing process, from initial mapping and analysis of an application’s attack surface, through to finding and exploiting security vulnerabilities.
- Alternatives to Burp Suite. Compare Burp Suite alternatives for your business or organization using the curated list below. SourceForge ranks the best alternatives to Burp Suite in 2021. Compare features, ratings, user reviews, pricing, and more from Burp Suite competitors and alternatives in order to make an informed decision for your business.
Clicking on the “Open proxy settings” button in the above screen opens up the computer’s Internet Settings. As shown in the screen below, we’re using Windows for this example.
In the above screen, click on the LAN settings button, which opens the screen below. At the bottom of this screen is the computer’s proxy settings.
As shown above, we’ve set the proxy settings for the computer to Burp Proxy’s default address and port (127.0.0.1 and 8080). If you’ve changed this information for your Burp Suite instance, use your modified values here.
When complete, click OK and attempt to browse to a website. For this example, we’ve used an HTTPS site. As a result, we see the warning below.
Clicking Advanced and Proceed to site allows us to actually visit the website. At this point, take a look at Burp Proxy. Under the Proxy → Intercept tab, you can see the requests as they move through. As shown below, we see the GET request for the requested website.
Forwarding the requests in Burp eventually allows the webpage to load (as shown below).
However, as shown in the address bar, the site is not considered secure. This is because Burp breaks the certificate chain between the client and the server and uses its own certificate instead. Since Burp’s certificate is self-signed and untrusted by the browser, Chrome makes it obvious to the user that this isn’t a secure connection.
But what if we try to visit a site using HTTPS Strict Transport Security (HSTS), where the site requires that a secure connection is made between the server and the client? The image below shows an attempt to browse to Google while Burp is performing interception.
As shown in the screen above, Chrome gives you no option to continue on to the untrusted site. Since Burp is providing its own (untrusted) certificate to the client, the connection is completely untrusted and not allowed to continue. In order to visit Google, we need to get Chrome to trust Burp Proxy’s certificate.
Making the jump to HTTPS
Burp Proxy generates its own self-signed certificate for each instance. In order to get a copy of your Burp CA certificate, browse to 127.0.0.1:8080 (or wherever your Burp Proxy instance is running). Once there, you’ll see the screen below.
In the screen above, click on CA certificate in the top right corner. This will allow you to save a copy of your CA certificate to your computer.
Once you have the certificate, you need to mark it as trusted in your browser. In Chrome, this option is under Settings → Advanced Settings → Privacy and Security. At the bottom of the screen below is an option to manage certificates.
Clicking on “Manage certificates” will open up a window for managing certificates locally on your computer. On Windows, you will see the screen below.
To force Chrome to trust Burp’s certificate, move to the Trusted Root Certification Authorities tab and click Import. Click through the prompts and point it to your newly downloaded certificate. Once you have received a success message, restart both Burp and your browser.
Browsing to our original site on infosec.com, we no longer get an error message about an untrusted certificate. Examining the certificate (shown below), we see that Chrome is perfectly happy to accept a certificate signed by PortSwigger CA, which is the company that makes Burp Suite.
Burp Suite Free Alternative Free
But what about interception for sites enforcing HTTPS via HSTS? Browsing to Google again throws no errors and, as shown below, Chrome accepts the PortSwigger CA certificate as valid.
At this point, we’re capable of intercepting any Web traffic using Burp Proxy.
Burp Suite Free Alternative Windows
Conclusion: Applications and limitations of HTTPS interception
As mentioned above, interception of HTTPS traffic is valuable for both benign and malicious purposes. A cyberdefender who can unwrap the encryption provided by TLS may be able to detect and remediate malware infections or threat actor intrusions on the corporate network. However, an attacker with the same capabilities poses a significant threat to the privacy and security of users on the network.
The fact that the user needs to trust the Burp proxy certificate can be an annoyance to the defender but is a significant bonus when dealing with malicious parties. An organization can force trust of the Burp CA (and many have similar policies for organizational root CA certificates for deep packet inspection), but this makes it necessary to appropriately protect the Burp proxy instance. Anyone with access to the private key corresponding to Burp’s self-signed certificate has the ability to read any data sent by browsers using the proxy.
- Download Burp Suite Community Edition, PortSwigger
- Intercepting HTTP and HSTS enabled HTTPS / SSL traffic on Chrome/Firefox using Burp Suite, Zeroday-Security
Burp Suite is a very good intercepting proxy and penetration testers find it very useful. Burp Suite Pro (unlike the free version) has some automation and integration capabilities. However, the main purpose of the tool is still manual pen testing. That is why Netsparker is the best Burp Suite alternative, but the two tools can also be used together.
Automated and Integrated Security Testing
To counter the lack of web application security specialists, companies often search for solutions that can perform web vulnerability testing automatically. Netsparker is an automatic web vulnerability scanner. It is also a vulnerability assessment and vulnerability management solution. With such a product, your experts use their precious time and skills to the most advantage.
Modern security tools need to fit into the company workflow. If you develop your own web applications, your teams certainly already use an issue tracker. It is necessary to assign priorities and keep track of bug fixing and new functionalities. A web application security scanner must be able to work with an issue tracker, too. This way, a vulnerability can be treated like a bug. Once reported, it can be assigned a priority, and when the developer finishes work, it can be automatically tested. This is how Netsparker works.
Early Vulnerability Elimination
If an error is found on a production server, it takes a lot of time and resources to fix it. Work must go back to the developer, the software must be tested on a staging system, and then a fix must be introduced to the production server. If your teams have a lot of work, this may take days or even weeks! Korg nanokontrol 2 ableton. That is why Continuous Integration (CI) workflows include a lot of tests to make sure that errors are caught as early as possible.
A vulnerability scan should be treated like one of the tests. It must be done as early as possible so that there are no security flaws that are discovered in a production system. It is even more important than for other bugs because security vulnerabilities such as SQL injections or Cross-Site Scripting (XSS) can introduce major risks. That is why a web application vulnerability scanner must be part of your SDLC. CI integration is one of the most important features of Netsparker. While Burp Suite has such capabilities, too, they are more generic.
You Cannot Afford False Positives
Imagine that someone comes to you and tells you that you have a malicious program on your computer. In such a case, you start looking for it. You download and install different software and spend many hours trying to find it. After a couple of hours, you think that this was not true, but you can never be sure. You may even stop trusting the person who told you about the malicious program.
This is exactly what happens when a vulnerability scanner reports a false positive. A security expert may spend many hours trying to find it, but they can never be absolutely certain. That expert may even lose the trust in the scanner if this keeps happening. That is why Netsparker’s Proof Based Scanning™ technology is so important. Every vulnerability comes with actual proof that it is not a false positive. This way, the penetration tester may easily reproduce it manually if necessary.
Burp Suite and Burp Suite competitors don’t have such technology. This is a very strong argument, why you should consider Netsparker as an alternative not only to Burp Suite but to many other products (also as an open source alternative). If you use other tools and you need to have absolute proof, your penetration testers must create such proof manually, which takes a lot of time.
Comprehensive Security Environment
You don’t have to use Netsparker alone. You may decide, that it should be the center of your complete web application security testing and network security environment. Netsparker works very well with other tools. You can use it as your first line of defense, and then use manual tools such as Burp Suite, Metasploit, or Kali Linux for exotic vulnerabilities and additional research to reduce potential attack surface even further.