I am testing an application that uses both regular http rest requests and websockets. Burp cert is installed on the device I am using for the tests. I can intercept the encrypted traffic using Burp. If I change Burp options to generate a "CA-signed cert with a specific hostname" during the normal operation, all the rest requests generate a connection error (due to hostname verification failure) but the websocket keeps working fine. I am not familiar with websocket internals. Is it normal for a websocket or is it a bug?
Does the websocket protocol check for the host name only on start or is it controlled for each message? I cannot start the app with custom hostname configuration because the initial rest requests will fail and the web socket connection phase will never be reached.
Edit: These are my test steps:
The app is a native Android app and all the traffic is encrypted using TLS. App uses both rest/http requests and websocket messages.
I installed Burp CA to the device.
- I opened Burp with default settings and configured Android phone to use Burp as proxy server.
- I started the Android app and used it for a few minutes. I can see HTTP traffic under Proxy->HTTP history tab and websocket messages under Websocket History tab.
- Then without closing the app, I go to Burp Proxy->Options tab, on Proxy Listeners field select the active interface, click on edit, move to Certificate tab. On tthis window I select Generate a CA-signed vertificate with a specific hostname and set the hostname to foo.bar.
- I continue to use the app wtih this setting. From this point forward all the rest requests generate an error, both on UI and Alerts tab of Burp. But websocket keeps working. I can intercept the messages and edit them.
The questions are:
q1. is this the intended behaviour or a bug?
q2. If this is supposed to happen because the ws connection checks the certificate only at initial setup, can an active attacker mitm my web socket traffic? For example after the connection is made, if the app is presented a trusted certificate like nsa.com, can nsa read the messages?