0

I am developing a web app and while testing it on burpsuite I found that it is vulnerable to the proxy SSL certificate.

I did some research and found that it was handled by a technique called SSL pinning. But the main problem in front of me is that most of the browsers have deprecated certain kinds of SSL pinning.

Please help me out in finding the right technique to deal with proxied SSL, I am kind of a noob in this domain.

0
1

It is unclear what exactly you want to prevent. MITM is only possible if the client side explicitly trusts the MITM (i.e. corporate proxy on firewall vs. attacker). So an attack against the client is not easily possible. Additionally HSTS can be explicitly said which makes overriding certificate warnings impossible on modern browsers.

You can also require a client certificate issued by a CA you control. This certificate is impossible to simply replicate by a MITM. And is thus effective against MITM in corporate proxies where the proxy CA was added as trusted to each clients CA store but where the proxy usually does not retrieve client certificates installed on the client. If there is a risk that the client certificate gets retrieved one can back it by a smart card so that physical representation of the smart card in the client is needed and nobody can replicate the client certificate. Of course, this makes it more complex since somehow the client must get and install the client certificate first.

If your goal is instead to prevent the client itself from reverse engineering or manipulating the application protocol by running some local MITM proxy (i.e. Burp or others) then neither client certificate nor SSL pinning would help. The client has full control over its site and can provide the proxy with the client certificate or could disable SSL pinning. In this case one could only try to obfuscate the protocol to make reverse engineering harder and to keep all important state and computation on the server side to protect against local modifications on the client side.

3
  • Thanks for the quick response, I was wondering how I would be able to obfuscate protocol, can you tell me some techniques? – Bond 007 Oct 10 '20 at 6:20
  • @Bond007: This would be both a different question and also too broad. It would depend on what you actually want to achieve, what kind of protocol you have etc. Note that you cannot slap "just make it secure" on top of anything and it will be fully protected. You would need to define your actual threats and risks first and the resources your are willing to spend to to mitigate the risks (which should somehow match the actual risks) and what kind of risks are acceptable for you to ignore etc. None of this is known here and thus no useful recommendation can given. – Steffen Ullrich Oct 10 '20 at 6:27
  • Ok, I am sorry that my problem was not well explained. Thanks anyway. – Bond 007 Oct 10 '20 at 7:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.