Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

tls termination

Andrew | Last updated: Jan 16, 2019 08:04AM UTC

Hi, Can burp do tls/ssl termination? That is to say, I want to test a site using HTTPS but one of the systems loaded in an iframe does not support HTTPS yet and I get mixed content errors in Chrome. While I would like burp to proxy the HTTPS request, terminate the TLS/SSL and pass the request on as plain HTTP to the backend, package the response using Burp's certificate and give it to Chrome. I only want this done for one specific subsystem domain.

PortSwigger Agent | Last updated: Jan 16, 2019 10:22AM UTC

Yes, you can do this. There is two steps: 1) Install the Target Redirector extension. This lets you redirect incoming HTTPS to outgoing HTTP for a specific host name. You can checks that https://foo.com is accessible in your browser. 2) The iframe src will still be http. You can add a match and replace rule to rewrite this. Look in Proxy > Options > Match and Replace

Burp User | Last updated: Jan 16, 2019 01:01PM UTC

Thanks, that worked like a charm!

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.