Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

external service interaction -- https

hong | Last updated: May 12, 2017 11:58AM UTC

I noticed Burp supports external service interaction -- DNS, http and SMPT. Do you have any plan to support external service interaction -- https? Recently we found our application is vulnerable (and exploitable) to external service interaction -- https. Thanks

PortSwigger Agent | Last updated: May 15, 2017 09:27AM UTC

Yes, Burp does detect HTTPS based interactions via Burp Collaborator. They are just labelled as generic HTTP interactions in terms of the issue names/descriptions. If you find a case that Burp doesn't report, please pass on relevant details, thanks.

Burp User | Last updated: May 15, 2017 01:00PM UTC

In my case, it is actually not "external service interaction" issue. Burp injected this string into payload: http://kxl7efljw50trrltrhkok6upngtbh15ssig7.burpcollaborator.net/api/types/loginSessionInfo/instances I wonder if Burp can inject https string, such as: https://kxl7efljw50trrltrhkok6upngtbh15ssig7.burpcollaborator.net/api/types/loginSessionInfo/instances Our validation agent will reject http request, but it will process https request. This will expose potential problem in our validation agent. Thank you

PortSwigger Agent | Last updated: May 15, 2017 03:17PM UTC