0

I'm using burp suite as proxy and configured my browser to it. I'm able to intercept SSL connection traffic of only some web applications using self-signed certificate issued by burp by adding exception to my browser. But when I try to do the same to google, it does not initiate TLS handshake and we cannot add any exception (as there were no packets related to handshake checked in wireshark). Is there any client side validation before handshake is initiated?

Improve this question

2 Answers 2

Reset to default
3

There could be a few reasons for this, but the most likely are HSTS, SPDY, and preloaded pinning:

  • HTTP Strict Transport Security (HSTS) is a mechanism by which a server can enforce that the server is only ever connected to via a secure connection (e.g. HTTPS) and that a valid certificate must be presented. Your browser will not allow the connection to initiate on an insecure protocol like plaintext HTTP, or if the presented certificate is not valid. You can't override this. If you're doing TLS MitM in Burp, your browser will reject the certificate as invalid unless you install the Burp CA in your browser.
  • SPDY is an alternative HTTPS protocol that Google uses a lot. It may well be that your browser is trying to initiate a SPDY connection, and that's perhaps why Burp isn't catching it.
  • Chrome comes preloaded with a set of server certificate rules for pinning. The idea is essentially that they preload HSTS rules for a bunch of common sites as part of the installer, but with the additional protection of including a fingerprint of the known certificate. This will cause any invalid certificates, even those with "valid" signatures (e.g. signed by a local CA), to be rejected.

My advice would be to install the Burp CA into your system's certificate store, and your browser if applicable. That should probably fix it.

Improve this answer
3
  • I doubt that it can be SPDY. SPDY is still using the default https port but uses the ALPN extension in the SSL handshake. By simply doing the normal man in the middle the ALPN from the original ClientHello between browser and Burp will be ignored and no ALPN will be used in the ClientHello to the server. Thus the server does not know that the client can do SPDY (HTTP/2.0) and simply downgrades to normal HTTP(S).
    – Steffen Ullrich
    Dec 4, 2015 at 11:37
  • @SteffenUllrich While that should be the case, Burp does seem to have trouble with SPDY sometimes. I've run into cases where it just won't show the traffic at all, or the requests show up but no response comes back.
    – Polynomial
    Dec 4, 2015 at 11:53
  • @Polynomial: I have tried it earlier. I have installed burp's certificate in trusted certificates in cert mgr.msc and also the fake certificate generated by the burp. Even then there no use. I cannot find client hello packet itself.(It might be burp's issue) any suggestions to get it done. (i'm using Firefox).
    – Narayan Kaluri
    Dec 9, 2015 at 4:47
2

I doubt that there is no SSL handshake because the browser will not know up-front which certificate it will get. But I'm sure there is no successful SSL handshake.

With google.com and any other sites protected by certificate pinning you will not be able to add an exception by design. What you need to do instead is to import the CA used by burp as trusted into the browser. This makes it also easier for all the other tests, since you will not need to add an exception for any other site afterwards since they are all considered trusted because they are signed by a trusted CA.

Improve this answer
6
  • I have tried it earlier. I have installed burp's certificate in trusted certificates in certmgr.msc and also the fake certificate generated by burp. Even then there no use. i cannot find client hello packet itself.
    – Narayan Kaluri
    Dec 8, 2015 at 12:30
  • @NarayanKaluri: how do you look for the ClientHello? Do you make a packet capture between browser and Burp or do you capture between Burp and server or any other ways?
    – Steffen Ullrich
    Dec 8, 2015 at 12:34
  • I use Wireshark to observe all the traffic that passes my LAN. for other web-servers I can observe client hello in that.
    – Narayan Kaluri
    Dec 9, 2015 at 4:30
  • @NarayanKaluri: this does not answer the question if you capture between client and Burp or Burp and the server. If you capture between Burp and the server only you will not see the ClientHello from the client to Burp but only that there is no ClientHello from Burp to the server.
    – Steffen Ullrich
    Dec 9, 2015 at 5:53
  • no idea, whether it goes to burp or not. Can u suggest me how to get them(where to configure and how).
    – Narayan Kaluri
    Dec 9, 2015 at 6:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .