Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Burpsuite does accept external connections on Mac OSX Catalina

Josue | Last updated: Jun 04, 2020 09:29AM UTC

I have burp running on the mac osx catalina and listening on all interfaces. in the mac osx firewall the burpsuite and java are allowed to accept incomming connections but the burp suite doesnt receive any traffic from the smartphones connected to it, but if I connect the smartphones with burpsuite on the windows laptop it works. I have tested this with 4 smartphones, 2 android and 2 iphones, everything works on windows. I have updated my java and java sdk but still doesnt work on mac osx catalina. Regards

Uthman, PortSwigger Agent | Last updated: Jun 04, 2020 09:41AM UTC

Can you provide more information on the devices and how you have set up Burp, please? What version of Android/iOS are you using? Do you have any issue intercepting traffic from your browser on your Mac too?

Josue | Last updated: Jun 04, 2020 11:40AM UTC

-- SET UP -- Macbook (running Mac OS X 10.15.5) Iphone X( running iOS 13.3.1) and iPhone 6( running iOS 12.4) Samsung S10(running Android 10) and S7 (running Android 6) Wifi router Burp suite version 2020.4.1 Macbook and the iPhone are connected to the wifi router. in the iPhone the proxy is the MacBook IP and 8080, configured on the burp suite listen on all IPs and port 8080. The same setup for Android devices. The 4 devices connected to the wifi can reach http:// burp and I can't see any traffic on the burp proxy history. On Android I have installed the certificates manually and iPhone too. I have turned off the firewall on Mac all together and I also tested with firewall on and accepting incoming connection on port 8080/burpsuite. MacBooks$ java -version java version "11.0.5" 2019-10-15 LTS Java(TM) SE Runtime Environment 18.9 (build 11.0.5+10-LTS) Java HotSpot(TM) 64-Bit Server VM 18.9 (build 11.0.5+10-LTS, mixed mode) MacBooks$ uname -a Darwin DRFSGSsMacBook.home 19.5.0 Darwin Kernel Version 19.5.0: Tue May 26 20:41:44 PDT 2020; root:xnu-6153.121.2~2/RELEASE_X86_64 x86_64 MacBooks$ NB: I don't have any issue intercepting traffic from my browser.

Uthman, PortSwigger Agent | Last updated: Jun 04, 2020 12:36PM UTC

Thanks for that information. I have replicated the issue on iOS 13 (13.4.1). I am getting a lot of issues with TLS negotiation when using Java 13 (a known issue). Can you please try the below? 1. Set up your proxy listener according to https://portswigger.net/support/configuring-an-ios-device-to-work-with-burp 2. Install the Burp CA cert on your device (you will likely do this under Settings > General > Profiles once you have download the cert from http://burp 3. Trust the certificate - Settings > General > About > Certificate trust settings > toggle PortSwigger CA to 'On' (green) 4. Download and install adoptopenjdk14 (you can do this using Homebrew) 5. Run Burp using this Java version (14.0.1) from the JAR like: java -Djdk.tls.server.protocols=TLSv1,TLSv1.1,TLSv2 -jar burpsuite_pro.jar Note: please run java -version once you have installed 14.0.1 to make sure that you are actually using that Java version. For Android, please try the following: - https://whiteoaksecurity.com/blog/2020/2/25/android-10-device-setup-for-penetration-testing - https://webkul.com/blog/configure-android-device-with-burpsuite/

Davis | Last updated: Sep 09, 2020 12:43PM UTC

Hi. I have the same issue on Burp Pro v2020.9.1. I am trying to connect intercept traffic from an Android phone (Oneplus 7T pro running Android 10). Burp is running on Mac OS Catalina 10.15.6. I have followed the guides and set-up the proxy settings and also started Burp using the additional flags. However, I get the same behaviour as Josue is describing. On my phone i can go to http://burp and download the certificate, and I can reach http://neverssl.com, but nothing is logged in the history. The only packet that I have captured is the following: GET /online HTTP/1.1 Host: bfckdhlnrmsvtxwz.neverssl.com User-Agent: Mozilla/5.0 (Android 10; Mobile; rv:80.0) Gecko/80.0 Firefox/80.0 Can you please help me intercept traffic from my Android phone?

Uthman, PortSwigger Agent | Last updated: Sep 09, 2020 12:47PM UTC

Hi Davis, Can you take a look at the documentation on our website, please? - https://portswigger.net/support/configuring-an-android-device-to-work-with-burp - https://portswigger.net/support/installing-burp-suites-ca-certificate-in-an-android-device Have you rooted the device and installed the certificate at the OS level?

Davis | Last updated: Sep 10, 2020 04:42PM UTC

I have followed both tutorials, but I have not rooted my phone. I was trying to get everything working for unencrypted traffic, but it does not work as expected and only a few packets gets picked up by Burp. I will try on a Windows computer in the coming days to compare the behaviour.

Davis | Last updated: Sep 11, 2020 06:39AM UTC