Burp Suite User Forum

Create new post

Does burpsuite perform ssl strip to intercept https requests?

[ | Last updated: Apr 25, 2022 10:22AM UTC

Does burpsuite perform ssl strip to intercept https requests?

Ben, PortSwigger Agent | Last updated: Apr 25, 2022 10:36AM UTC

Force use of TLS - If this option is configured, Burp will use HTTPS in all outgoing connections, even if the incoming request used plain HTTP. You can use this option, in conjunction with the TLS-related response modification options, to carry out sslstrip-like attacks, in which an application that enforces HTTPS can be downgraded to plain HTTP for a victim user whose traffic is unwittingly being proxied through Burp. - https://portswigger.net/burp/documentation/desktop/tools/proxy/options#proxy-listeners

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.