2

I'm trying to capture Request/Responses using Burp on Mozilla. I've configured Burp Proxy on 8080 and have set same proxy settings on Firefox however when trying the Gmail link, Firefox gives "This Connection is Untrusted" error message.

While other pages are allowed like Google which also work on HTTPS. Help me with this so that I can run Burp to capture request/responses ?

4 Answers 4

3

You will get that error when you access Gmail, and there isn't really anything you can do about it, except to try different browsers.

This is due to HSTS (HTTP Strict Transport Security) which Google has implemented along with the option to include certificate pinning. This means that in order to access their sites without this warning, you need not only a certificate that your computer believes is valid, but specifically a certificate that Google has said is valid. Without an actual cert that Google has pinned, the connection won't be trusted.

HTST is generally implemented as a header so if you're an active man-in-the-middle you might have a chance to strip the header (or at least modify it to not include cert pins) before it gets to the browser, preventing it from thwarting you, but not even this method will work with Gmail, since Google properties (among others) are pat of the preloaded HSTS set that comes with some browsers, including Chrome and Firefox. This means that your browser comes pre-installed withe the knowledge that Gmail requires HTTPS and specific, pinned certificates.

So, try different browsers, and try to strip any pinned certificates off the Strict-Transport-Security response header before it gets to the browser so that they won't impact your ability to MitM in browsers that don't have Gmail in a preloaded HSTS list.

1
  • This is weird: I just tried right now to configure Burp as tls proxy, and there are no problems. According to Mozilla's wiki ( wiki.mozilla.org/SecurityEngineering/Public_Key_Pinning ) pinning for google has been added only in Firefox33 (released 14 October 2014) were people here using a Nightly/Beta version of Firefox? On top of it, even with pinning, it should just work since Firefox's enforcement level is set to 1 (Allow user Mitm, just like in Burp's case)
    – berdario
    Feb 23, 2015 at 17:24
2

to deal with the https problem, you need to add the burp certificate to your browser.

Firstly: under the proxy tab choose options and export your certificat from burp, save it somewhere:

enter image description here

secondly: lunch your browser, go to Chrome Settings/Preferences/Under The Hood/Manage Certificates/Trusted root certification autorithy Tab and click the Import button.

enter image description here

After that, I think You may need to restart Chrome

For firefox you could make the same manipulation, however to get the burp certificat you visit this url: //burp/cert. enter image description here then, go to options>advenced>certificats>display certif>autorithy and upload the burp certif.

after that restart firefox and retry :

enter image description here

4
  • I do not think this will work when the OP accesses Gmail, because of what the accepted answer states.
    – schroeder
    Mar 31, 2016 at 0:22
  • Yup. It's not an HTTPS problem per se, it's a pre-loaded pinned cert problem. You can't bypass a pre-loaded pinned cert and HSTS the same way you can handle any generically validated HTTPS certificate.
    – Xander
    Mar 31, 2016 at 0:55
  • Please note that the OP is asking about Firefox, not Chrome.
    – schroeder
    Mar 31, 2016 at 20:23
  • the same solution is ok for Firefox, however if you find a problem to get the burp certif you could tape in the browser : burp/cert to get it. Apr 1, 2016 at 9:45
1

If you want to intercept SSL traffic, you'll need to install the burp CA cert. See the burp docs for details.

1
  • Installed the PortSwigger Certificate and imported it in Mozilla, still it's giving the same error for "This Connection is Untrusted" when trying the gmail.com
    – harveyD
    Sep 30, 2014 at 9:54
0

When you import the CA certificate, you should make sure the valid email option is being checked. And when you try to connect to a HTTPS website, and the browser pops out

ssl_error_rx_record_too_long.

there is something you can do:

  • type about:config in the address bar
  • search security.tls.version.max in the results
  • modify the value from 4 to 3

Then it should go on well.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.