3

Even though we are using a proxy, it is sufficient to check the certificate hierarchy and when it's the same inside the companys network and in my home network, I can conclude I'm not being sniffed the inputs I do You can conclude that you are not sniffed for this specific site and this specific time only. The procedure of the proxy-server to "insert" a ...


2

It should be secure overall, but it's not as secure as a direct communication (endpoint <-> website) would be, because there is another section that could get compromised (endpoint <-> proxy <-> website) by the attackers and leak your data. If they want to, they can snoop on everything you are doing and you have agreed to that by signing your work ...


2

Certificate Transparency (CT) does not apply to non-public root Certificate Authorities. CT only validates that certificates issues by trusted public CAs were issued legitimately. Your Burp Suite certificate is configured on your system as a trusted root certificate and no CT policy will therefore be applied to it. The Mozilla MDN page on Expect-CT also ...


1

I see three issues with this: An attacker could set other query parameters than uid by e.g. using 123&foo=bar. Depending on how your site and how website.com works, this could lead to unexpected behaviour. To mitigate this, use some sort of whitelisting or filtering. E.g. if uid should always be a number, check that $_GET['uid'] only contains digits ...


1

If you want to tunnel any traffic you need to provide a tunnel entry at the network or IP layer and similar a tunnel endpoint too. A HTTP proxy is only an endpoint at the HTTP layer and can at most be used to tunnel TCP traffic with HTTP CONNECT request. And many HTTP proxies also restrict which ports or protocols such TCP traffic can use (i.e. HTTPS and ...


1

The "misbehaving" pcap has a capture for HTTP proxy traffic on port 443, i.e. a HTTPS traffic prefixed by a HTTP CONNECT request and response. Port 443 is reserved for direct HTTPS though and not for proxied HTTPS. It looks like Wireshark somehow insists that it should be either direct HTTPS on this port (which is how the port is commonly used) or that it ...


1

There are different kinds of proxies and explicit configuration is only needed in some cases: Transparent proxies don't need any kind of configuration, they just need to be in the path of the traffic. The client is not really aware of the proxy in this case. DNS resolution will be done at the client. To get the proxy in the path typically some ports on the ...


1

I'm going to take a stab at answering this even though you haven't really provided enough information to be clear about how your proxy works and what it's intended to do. I am assuming the following: All access to the Internet is filtered through this proxy; it's either invisible on the network gateway or any program not configured to use the proxy won't ...


1

Some parts of the webpage (for example images) are loaded using a insecure connection. This parts could be changed by a MitM attacker without you noticing it. You can use a service like whynopadlock.com or the developer tools of your browser to find out what exactly causes this! In this specific case, three images are included using a unencrypted http ...


1

Try using the same tools and strategy but with one modification. Before you do all that first try to setup a fake hotspot. You will need additional wireless adapter which supports monitor mode. No matter if you use framework or you setup hotspot manually. I think that SSLStrip is much more effective when all the traffic are literally flying trough you. You ...


1

after a lot of searching I just found out that Bettercap 2.x apparently just does not do the HSTS bypass thing. The sslstrip from the http.proxy module works just fine, I've tested it on my network, all the HTTPS website where now HTTP, however Chrome, Firefox and so on block them cause you visited them once with HTTPS, some website are still visitable by ...


1

SSLStrip converts HTTPS to HTTP Not exactly; you cannot "convert HTTPS to HTTP" once a SSL/TLS connection has been established (unless the server sends the client such a redirect, but you cannot impersonate the server without its private key). It only does this in the sense that URLs are rewritten from https:// to http://. SSLStrip will work ...


1

You can't. You can explicitly check the certificate used in your app.This will make it harder for anyone to use a MITM proxy. But if the app is running on the device of the attacker, they can change the code and allow their own certificate.


1

You need to add a "match and replace" rule. Under Proxy > Options > Match and Replace, click the Add button, and fill in the necessary fields so that if the request body contains that URL, Burp will remove it from the request. You could also remove all JavaScript resources by ticking the Remove all JavaScript field under Response Modification.


Only top voted, non community-wiki answers of a minimum length are eligible