0

When i'm trying to intercept the mobile traffic using burp suite. Getting this error "No Cipher suite in Common" I tried to add all the available cipher suits in the burp but still getting this error. (i.e I'm trying to intercept instagram and facebook traffic)

Is this related to Certificate Pinning ??

  • It's definitely not cert pinning; this error occurs at a point in the protocol well before it is possible to check the cert. – dave_thompson_085 Nov 23 '18 at 9:53
1

Burp relies on the underlying Java platform for all key handling algorithms and SSL ciphers/protocols, so Burp will be constrained by whatever is available in your installation.

Are you using the latest version of Burp (2.0.12)? We made some changes to try to ensure that all available SSL ciphers are made available to Burp. Also, if you are using the plain JAR file, please try the platform installer, which comes bundled with its own JRE.

  • Thank you @PortSwigger, I'm using Community edition of the burp suit and its version is 1.7.36 and Java Version is 1.8.0_131 – Ash Roy Nov 23 '18 at 6:19
  • 1
    Oracle 8u131 was still subject to the 'export limited crypto' policy issue (changed in 8u161 up). If the apps are offering only 256-bit ciphers, that would cause no-shared-cipher. Can you (1) get a 'wire' trace or -Djavax.net.debug=ssl to see what client is offering and/or (2) (download and) install the 'unlimited policy' jars? – dave_thompson_085 Nov 23 '18 at 9:57
  • Thank you @dave_thompson_085, i updated the java installation to 8u191, and the server Prefers "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", Yeah unlimited policy jar's are in place – Ash Roy Nov 25 '18 at 4:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.