0

When doing bug bounty, there are some sites, which prohibit for good reasons to intercept the requests and responses (with SSL) to the site with Burp and other proxies. So I have the problem to get the content of the requests / responses especially AJAX things. My question is this: Are there any alternative tools to Burp / proxy software to get this information?

What I up to now found, was HTTP Live Header plugin for Chrome / Firefox, but they only show header.

  • 1
    "there are some sites, which prohibit for good reasons to intercept the requests and responses" - There is not really any mechanism for that. What's more likely is that you didn't install the root cert correctly or misconfigured Burp in some other way. – Arminius Nov 13 '17 at 10:14
  • @Arminius: actually, you could probably detect use of some MITM vs. direct browser by fingerprinting the TLS ClientHello. Browsers differ in use and order of TLS extensions, order and amount of ciphers they offer etc. This was for example done in The Security Impact of HTTPS Interception to detect when MITM was used. Still, it is unclear what is the exact problem here and thus it is unclear what alternative ways to get the information could work. – Steffen Ullrich Nov 13 '17 at 10:45
  • @SteffenUllrich Agreed that there are heuristicts to detect a MITM. Even techniques to detect Burp in particular. However, OP seems to assume there is some widely used mechanism that hosts use to prevent any interception proxy from working which seems unlikely to be OP's actual issue. – Arminius Nov 13 '17 at 11:12
  • @Arminius: Yes, I also think that the OP is not really aware what the real problem is and just assumes that it is caused by the server detecting SSL interception. – Steffen Ullrich Nov 13 '17 at 12:03
2

Depending on your actual needs -

  • Most browser development tools let you see requests / responses including content. Open it (For chrome Ctrl+Shift+I) before loading the page.
  • There are several browser add-ons for modifying requests in flight. Tamper Chrome for example.
  • Why doesn't Burp work? Have you added Burps CA cert?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.