0

When i'm trying to intercept the mobile traffic using burp suite. Getting this error "No Cipher suite in Common" I tried to add all the available cipher suits in the burp but still getting this error. (i.e I'm trying to intercept instagram and facebook traffic)

Is this related to Certificate Pinning ??

1
  • It's definitely not cert pinning; this error occurs at a point in the protocol well before it is possible to check the cert. Commented Nov 23, 2018 at 9:53

1 Answer 1

1

Burp relies on the underlying Java platform for all key handling algorithms and SSL ciphers/protocols, so Burp will be constrained by whatever is available in your installation.

Are you using the latest version of Burp (2.0.12)? We made some changes to try to ensure that all available SSL ciphers are made available to Burp. Also, if you are using the plain JAR file, please try the platform installer, which comes bundled with its own JRE.

3
  • Thank you @PortSwigger, I'm using Community edition of the burp suit and its version is 1.7.36 and Java Version is 1.8.0_131
    – Ash Roy
    Commented Nov 23, 2018 at 6:19
  • 1
    Oracle 8u131 was still subject to the 'export limited crypto' policy issue (changed in 8u161 up). If the apps are offering only 256-bit ciphers, that would cause no-shared-cipher. Can you (1) get a 'wire' trace or -Djavax.net.debug=ssl to see what client is offering and/or (2) (download and) install the 'unlimited policy' jars? Commented Nov 23, 2018 at 9:57
  • Thank you @dave_thompson_085, i updated the java installation to 8u191, and the server Prefers "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", Yeah unlimited policy jar's are in place
    – Ash Roy
    Commented Nov 25, 2018 at 4:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .