Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Burp Proxy Forces HTTPS in the firefox private WIndow

Green | Last updated: Jan 30, 2022 08:24PM UTC

Hi Burp Team, I recently start facing issues when proxy is enabled in firefox private browsing. In private windows the website force to make HTTPS connection and then fails giving "Failed to connect to wekor.thm:443" error. So, basically: 1. Normal Firefox with Proxy > http://wekor.thm working fine 2. Private Tab with Proxy > auto redirects to https://wekor.thm and connection failed 3. Private Tab with no Proxy > no redirect, http://wekor.thm works fine. I have uploaded an image here https://ibb.co/vQ2H9Qv. Firefox Version: 91.4.0esrs Burp: Burp Pro 2021.12.1 Why proxy is forcing HTTPS in private window, if i disable proxy then everything works find. Also, Under Proxy > Options > Force use of TLS is not checks. Thanks, Green.

Green | Last updated: Jan 30, 2022 08:39PM UTC

Hi, Here is another example https://ibb.co/t2bkx0x. This is HTB box "Meta" - 10.10.11.140. Same behavior, working find in Normal firefox, forcing HTTPS in firefox private windows and erroring out because 443 is closed. I came across this article https://blog.mozilla.org/security/2021/08/10/firefox-91-introduces-https-by-default-in-private-browsing/. It's falls back if no proxy enabled (like first screenshot) but if fails if proxy is enabled. Thanks.

Michelle, PortSwigger Agent | Last updated: Jan 31, 2022 04:11PM UTC

Thanks for your message. Are you seeing this behavior with any other browsers, e.g. Burp's embedded browser? Do you see this behavior using other versions of Firefox or is it specific to this version?

Green | Last updated: Jan 31, 2022 10:56PM UTC

Thanks for reply, So Burp's embedded browser, working fine. Checked on Firefox 78.17.0 and work fine as well. So looks like It's version 91 and above, as per mozilla's article https://blog.mozilla.org/security/2021/08/10/firefox-91-introduces-https-by-default-in-private-browsing/. The issues is the page falls back to http if there is no proxy, but it fails when proxy is active. Thanks!

Michelle, PortSwigger Agent | Last updated: Feb 01, 2022 01:08PM UTC

Thanks for the update. We've run a couple of tests here but haven't quite seen the same behavior as you did with your test, although we have tested with different sites we were using the same version of Firefox. To help us replicate this issue, can you email support@portswigger.net with the following, please: - A screenshot of the proxy settings you have configured in Firefox - A screenshot of the Privacy & Security -> HTTPS-Only mode in Firefox - An example of a publicly accessible site where you see this issue if possible - An export of your Burp User Options (Burp -> User Options -> Save) and Project Options (Project -> Project Options -> Save Project Options) - Screenshots showing the settings configured under Proxy -> Options Can you also confirm if you see this issue if you use the latest version of Firefox?

Green | Last updated: Feb 02, 2022 03:45AM UTC

Thank you, Just updated to firefox 91.5.0 and still same behavior. :( Sent an email to support@portswigger.net with all possible details and screenshots, should be enough to reproduce the issue. Thanks, G.

Michelle, PortSwigger Agent | Last updated: Feb 02, 2022 08:40AM UTC

Thanks for sending the email, we'll take a look through it and be in touch soon.

norwegianlamb | Last updated: May 05, 2022 01:33PM UTC

I'm having the same exact problem: enabling the proxy forces every request to be HTTPS, the only way I have to "disable" this, is intercepting all requests and manually setting them to port 80. If you solved this, could you help me out too?

Uthman, PortSwigger Agent | Last updated: May 05, 2022 01:50PM UTC

norwegianlamb | Last updated: May 05, 2022 02:14PM UTC

Actually, I'm pretty dumb, I didn't even try visiting any other website other than the one I was trying to access to. But I still can't figure out why it does this with these websites: I'm trying to access sites I added on /etc/hosts (I added: <Server_IP> <website1> <website2> ...), and they can only be accessed with HTTP but when proxy is enabled it forces HTTPS. Is this somehow related?

Uthman, PortSwigger Agent | Last updated: May 06, 2022 12:06PM UTC

Hi norwegianlamb,

Did the suggestion in my previous post make any impact?

norwegianlamb | Last updated: May 06, 2022 12:23PM UTC

Unfortunately It didn't work for those hosts!

Uthman, PortSwigger Agent | Last updated: May 06, 2022 12:25PM UTC

Thanks for the feedback.

Can you please email support@portswigger.net with more detail on your issue? Ideally, a screen recording or screenshots, some example hosts, and diagnostics taken after the issue has been replicated (Help > Diagnostics)

Green | Last updated: May 06, 2022 06:54PM UTC

I spent almost 2 weeks, provided video screen captures but still there was no luck/solution and then i decided to leave it. But yes, still no solution for me either. Thanks, G.

Adrian | Last updated: Jul 10, 2022 11:35PM UTC

Hello everyone, Just out of curiosity, is anyone using FoxyProxy along with Burp? Cause this issue only occurs for me when using FoxyProxy. However if I set up a Proxy through Firefox manually, this issue does not occur for me. 1) Settings => General => Network Settings 2) Manual proxy configuration => 127.0.0.1:8080 3) DO NOT use it for HTTPS, just HTTP I tried looking into FoxyProxy's settings to see if there is something that is forcing HTTP to go to HTTPS when it comes to names in /etc/hosts. But at least this other way is a nice workaround. Tested it on META from HackTheBox (mentioned above) and another box that just released and no issues.

Peter | Last updated: Sep 22, 2022 05:54PM UTC

Same problems here with Kali on latest release and use with FoxyProxy to proxy with Burp. Used it about 2 years without problems and now it answers via https and I can't modify that. The workaround seems to work somewhat but still problems with response to changed intercepted response from Burp.

Bob | Last updated: Nov 23, 2022 07:23PM UTC

I ran into the same problem. In FF address bar, type about:config Search for https flip dom.security.https_first_pbm to false flip dom.security.https_only_mode_pbm to false Now I can use FoxyProxy with Burp without the http request becoming an https request.

Peter | Last updated: Dec 16, 2022 01:47PM UTC

Thanks Bob!!! This also solved my problem with similar situation. Best regards, Peter

| Last updated: Apr 11, 2023 10:53AM UTC

I ran into the same issue recently after upgrading Burp Suite and FF today. It's a FF issue, as Bob's solution worked as fine for me. Using FF 109.2.0 and Foxyproxy for the config.

Liam, PortSwigger Agent | Last updated: Apr 11, 2023 02:08PM UTC

Thanks for the update, Bob.

Di | Last updated: May 17, 2023 07:48AM UTC

Thanks Bob, saviour

| Last updated: Jun 13, 2023 09:39AM UTC

Hi Team, After upgrading to version 2023.5.3, i am being redirected to https in all web applications, even though my settings are default. I have tried accessing the application in burp default browser, firefox and chrome.

Dominyque, PortSwigger Agent | Last updated: Jun 13, 2023 12:22PM UTC

Hi Have you tried to enable 'Convert HTTPS links to HTTP' under Settings> Tools> Proxy> Response modification rules?

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.