2

My Application has a ssl Certification. But when i intercept the app with a tool, am able to see the sensitive information in a plain text. How can it happen? Will the Tool Breaks the SSL connection between the browser and the server? or any other Man in Middle attacks are happening here?

  • Did you add Burp's CA to your browser? In that case, you gave it the authority to re-encrypt the SSL conversation using its own toolset. The connection is not broken: the chain of trust is compromised (by user action). See: portswigger.net/burp/help/proxy_options_installingCAcert.html – Piskvor Dec 4 '15 at 8:03
  • Thank you for your Response. Now my doubt is when i use the same Burp for some other application(Banking Related), the data is shown in encrypted form. As said when it can decrypt the data why cant it be able to decrypt for certain applications?? – Nikhila Dec 8 '15 at 10:52
  • Perhaps it's not going through Burp? Or uses some different encryption system instead of HTTPS? – Piskvor Dec 8 '15 at 10:53
4

Check the certificate shown in your browser when you are accessing your application. You should see that it claims to be from a company called Portswigger who are the manufacturers of Burp.

What is happening is that your browser, proxies through Burp, is picking up that certificate, and encrypting traffic with it. Burp can decrypt that traffic, and display it. It also reencrypts the traffic with the original server certificate and sends it to the server for processing.

The same happens in reverse for responses. It is effectively a man in the middle attack, but one that you are running against yourself.

There are ways to protect against this, but they aren't always appropriate for web applications due to browser support issues.

  • 1
    Thank you for your Response. Now my doubt is when i use the same Burp for some other application(Banking Related), the data is shown in encrypted form. As said when it can decrypt the data why cant it be able to decrypt for certain applications?? – Nikhila Dec 8 '15 at 10:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.