Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Burp Professional with TLS_PSK

Sam | Last updated: May 14, 2020 06:10AM UTC

Hello all, I am testing out software that utilizes the TLS_PSK_WITH_AES_128_CBC_SHA (0x008c) cipher suite. However, Burp does not see this as a valid cipher. I have tried enabling all TLS suites in the Project Options and still receive the unsupported cipher error. Additionally, I have attempted to modify my Java crypto settings to "unlimited" and used the JCE compatible JAR files which still do not accept the TLS_PSK cipher. Is there a way to modify Burp or Java to support the specific TLS_PSK cipher? Thanks!

Hannah, PortSwigger Agent | Last updated: May 14, 2020 07:34AM UTC

Hi Burp gets its protocols and ciphers from your version of Java. Are you using the latest platform version or the standalone JAR? Have you tried changing your Java version?

Hannah, PortSwigger Agent | Last updated: May 14, 2020 08:10AM UTC

On looking into this further, neither Java nor the BouncyCastle support PSK authentication. This means you will be unable to modify Burp to support this particular cipher. You could try proxying your Burp traffic through a different tool that does support TLS_PSK before it goes to Burp.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.