0

When doing bug bounty, there are some sites, which prohibit for good reasons to intercept the requests and responses (with SSL) to the site with Burp and other proxies. So I have the problem to get the content of the requests / responses especially AJAX things. My question is this: Are there any alternative tools to Burp / proxy software to get this information?

What I up to now found, was HTTP Live Header plugin for Chrome / Firefox, but they only show header.

Improve this question
4
  • 1
    "there are some sites, which prohibit for good reasons to intercept the requests and responses" - There is not really any mechanism for that. What's more likely is that you didn't install the root cert correctly or misconfigured Burp in some other way.
    – Arminius
    Nov 13, 2017 at 10:14
  • @Arminius: actually, you could probably detect use of some MITM vs. direct browser by fingerprinting the TLS ClientHello. Browsers differ in use and order of TLS extensions, order and amount of ciphers they offer etc. This was for example done in The Security Impact of HTTPS Interception to detect when MITM was used. Still, it is unclear what is the exact problem here and thus it is unclear what alternative ways to get the information could work.
    – Steffen Ullrich
    Nov 13, 2017 at 10:45
  • @SteffenUllrich Agreed that there are heuristicts to detect a MITM. Even techniques to detect Burp in particular. However, OP seems to assume there is some widely used mechanism that hosts use to prevent any interception proxy from working which seems unlikely to be OP's actual issue.
    – Arminius
    Nov 13, 2017 at 11:12
  • @Arminius: Yes, I also think that the OP is not really aware what the real problem is and just assumes that it is caused by the server detecting SSL interception.
    – Steffen Ullrich
    Nov 13, 2017 at 12:03

1 Answer 1

Reset to default
2

Depending on your actual needs -

  • Most browser development tools let you see requests / responses including content. Open it (For chrome Ctrl+Shift+I) before loading the page.
  • There are several browser add-ons for modifying requests in flight. Tamper Chrome for example.
  • Why doesn't Burp work? Have you added Burps CA cert?
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .