Skip to main content
20 votes

How to configure Burp Suite for localhost application

If none of these solutions work for you, like they didn't work for me, you could try to change value network.proxy.allow_hijacking_localhost to true (using firefox v 67.0.1 64-bit). Open new tab, ...
Java-Kree's user avatar
  • 329
14 votes
Accepted

What are the differences between Burp and OWASP ZAP?

It is true that both tools are in the same space. Burp is a commercial closed source tool (which can be extended) developed by a commercial company while ZAP is a free open source tool developed by ...
Simon Bennetts's user avatar
11 votes
Accepted

How to configure Burp Suite for localhost application

In Burp go to Proxy / Options / Proxy listeners, and confirm the Running box is ticked. In proxy tab make sure intercept is turned off. Make sure the proxy in burp listener is 127.0.0.1:6666. ...
Lester T.'s user avatar
  • 1,293
10 votes
Accepted

Strange response body in burp suite

The response of the server reply is Brotli encoded: Content-Encoding: br I think that the Burp Suite doesn't decode this, so you're seeing the compressed version of your response. For more ...
sven.to's user avatar
  • 606
9 votes
Accepted

Disable or bypass SSL Pinning/Certificate Pinning on Android 6.0.1

Did you go through these procedures to get JustTrustMe to bypass the cert pinning -- http://www.welivesecurity.com/2016/09/08/avoid-certificate-pinning-latest-versions-android/ -- ? If you are just ...
atdre's user avatar
  • 19.1k
8 votes

Proxying MetaSploit through BurpSuite

Use the PROXIES environment variable (while in msfconsole) : set PROXIES HTTP:127.0.0.1:8080 Or run Metalsploit with proxychains (config at /etc/proxychains.conf) http://proxychains.sourceforge.net ...
Jonathan Allon's user avatar
7 votes
Accepted

In what situations can element.setAttribute allow XSS?

setAttribute() is safe in that it does nothing more than setting the attribute's value. Even by using special characters in the string you cannot inject an additional attribute (as you attempted in ...
Arminius's user avatar
  • 44.9k
7 votes
Accepted

Web App Pentesting: When enumerating website directories and files, how to tell if HTTP 200 is a valid page, or a failure page?

Web Applications and HTTP Status Codes If it's returning 200 on both an unauthorized page (302 Redirects to 200 login page), and an authorized page (discovered authorized page), there are some things ...
Mark Buffalo's user avatar
  • 22.6k
7 votes
Accepted

Can't Download Burp's CA Certificate from http://burp

These are your options: http://burp - it failed for you for some reason http://localhost:8080/ - or your burp proxy address and port Proxy > Options > Import / Export CA Certificate > Export in your ...
Lucian Nitescu's user avatar
7 votes
Accepted

Burpsuite: just passthrough firefox detect portal

Disable Captive portal from firefox as seen in this link. In order to do that open a new tab and type about:config, then search for network.captive-portal-service.enabled and set it as false then you ...
Dimitrios Desyllas's user avatar
7 votes
Accepted

Why does the file "shell.php.jpg" can execute as a php file but "shell.jpg" cannot?

shell.php.jpg should be treated as a .jpg file You're exploring DVWA, so not every should be means is. If I had to guess, the upload script properly checks the extension of the file and allows it, ...
Andrew Morozko's user avatar
6 votes

vuln Cross-origin resource sharing: arbitrary origin trusted

https://xrmtfgxgjkzw.com is just an example generated by Burp. What it is in fact saying is that any website on the internet that the user is visiting can grab content from your site (possibly private ...
SilverlightFox's user avatar
6 votes
Accepted

Intercepting Android app traffic with Burp

First thing to remember is that Burp is a HTTP(S) proxy. It doesn't do anything about any data which isn't HTTP(S) (OK, except websockets). Android apps, on the other hand, can use any protocol they ...
Matthew's user avatar
  • 27.4k
6 votes

Password shows as plaintext via burp suite interception for HTTPS request, is it an issue?

It's not a vulnerability. Since the page transmits the password via HTTPS, it's encrypted before being sent on the network. You allowed Burp to decrypt any encrypted traffic by adding their ...
Benoit Esnard's user avatar
6 votes
Accepted

Preventing a Burp and Intercept

You may want to ask the reporter to explain what they think the security implications are. Tricking the browser into showing a successful login via a locally forged API response does no harm unless ...
Arminius's user avatar
  • 44.9k
6 votes
Accepted

How to intercept and replace request URL through Burp Proxy?

There is a sample extension to do this. Here is the description: This extension demonstrates how to redirect outgoing HTTP requests from one host to another. This task might arise, for example, if ...
PortSwigger's user avatar
6 votes

Mutual TLS and Cert Pinning solving the same problem?

While mutual TLS and certificate pinning are intended for different problems they can be used to solve the specific problem of detecting active MITM too. Only, with mutual TLS it is the server which ...
Steffen Ullrich's user avatar
5 votes

How to configure Burp Suite for localhost application

Try adding a '.' after "localhost". This should solve your problem. eg. http://localhost.:8080/WebGoat/ This will force the localhost to use the same proxy settings as one would with an internet ...
mahesh takkalwad's user avatar
5 votes

Pentesting web applications with unique strings in URL

Burp supports Macros and Session Handling Rules that are designed to cope with this kind of situation. For example, you can configure a macro that fetches a fresh token, and a rule that updates the ...
PortSwigger's user avatar
5 votes
Accepted

How is intercepting my own HTTPS traffic possible?

Say you want to access SomeService's homepage through an HTTPS proxy. You start by making a connection between you and your proxy. Then your proxy makes a connection between itself and SomeService. ...
Burak's user avatar
  • 186
5 votes

HTML payloads work on burp but not on browser

When using Burp, you are injecting the code directly to the server without the browser-side javascript or tools. When you enter the payload on the browser, it is processed by the browser-side ...
schroeder's user avatar
  • 131k
5 votes
Accepted

How does Burp Suite evaluates this request as high severity with the issue "user input evaluated as code"?

The automated scan result is showing a potentially exploitable issue. Like every other automated scan result, you would have to perform a false positive analysis. The easiest way to analyze this ...
Shurmajee's user avatar
  • 7,487
5 votes

Burp Proxy vs MITM

The purpose of HTTP interception proxies is not to MitM requests of another user, and does not represent such attacks like you have stated. Instead, the purpose is to modify/craft requests in ...
multithr3at3d's user avatar
4 votes
Accepted

Where is the BurpSuite CA HTTPS certificate located?

Two ways to get the CA cert - 1) Make sure your browser is pointing to the Burp proxy Interface Url and Port and navigate to http://burp and click on "CA Certificate" on the top right. In your ...
katrix's user avatar
  • 563
4 votes
Accepted

Configure Firefox the use Burp proxy

You have probably configured firefox correct, but you have intercept on, in the proxy-intercept tab turn of interception or forward/drop the request.
codah's user avatar
  • 56
4 votes

Check for insecure CORS settings with cURL

You should only specify the origin header in your request. The application will respond with the Access-Control-* headers. Try only specifying the origin header and see what the result looks like. ...
user144242's user avatar
4 votes

Burpsuite: just passthrough firefox detect portal

When you get a request in BurpSuite that you don't want to intercept again, click the "Action" button, followed by "Do not intercept...", and choose "requests to this host". This should solve the ...
multithr3at3d's user avatar
4 votes
Accepted

Optimal way to capture HTTP(S) traffic on proxy-unaware iOS applications

This has been a rather interesting turn of events, apparently, the issue with VPN/Burp Suite method had to do with my configuration of the Burp Suite's invisible proxying (in which I neglected after ...
Pan Ziyue's user avatar
  • 171
4 votes

How is intercepting my own HTTPS traffic possible?

When you don't attack traffic using MITM, TLS works like this: Client <===========> Server When you attack traffic using MITM, you get a third party to intercept and proxy communication ...
oleksii's user avatar
  • 1,068
4 votes
Accepted

XSS vulnerability through burp suite

If you can't verify the result of an automated tool, it is not a good idea to report it's findings. Automated tools are great, but they have a problem with false positives.
Joe M's user avatar
  • 3,012

Only top scored, non community-wiki answers of a minimum length are eligible