Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

SSL session establishment using burp

Geetanjali | Last updated: Oct 12, 2017 09:00AM UTC

Hi Team, I just wanted to understand how SSL handshake takes place when burp lies between browser and server. Could you please provide some information on it. Thanks & Regards Geet (Security Ananlyst)

PortSwigger Agent | Last updated: Oct 12, 2017 09:15AM UTC

Hi Geet, Thanks for your message. Burp is an SSL breaking proxy. It terminates the SSL connection from your browser to Burp, and makes a fresh connection from Burp to the target server. The certificate it returns to the browser is generated using a certificate authority that is generated for your install of Burp. That's why you have to follow the certificate installation instructions to avoid browser warnings: - https://support.portswigger.net/customer/portal/articles/1783075-installing-burp-s-ca-certificate-in-your-browser

Burp User | Last updated: Oct 20, 2017 08:55PM UTC

Hello Geetanjali, I recently wrote a post that explains how the interception occurs. I hope it will help you to understand this issue. https://medium.com/@ethicalevil/how-http-proxies-read-tls-traffic-from-browsers-f15364e91226 Also , I believe that saying "Burp breaks SSL" is technically incorrect. We actually break the Public Key Infrastructure (PKI) trust model by installing a fake Root CA certificate in Browser. The TLS protocol is not vulnerable to MITM attacks.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.