Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Intercepting Domain Requests in Pass-Through Mode

Alberto | Last updated: Mar 19, 2024 08:47AM UTC

Good morning, I've recently shifted my focus to mobile pentesting and started exploring new ways to utilize Burp Suite Pro, distinct from my previous web app pentesting practices. My current challenge revolves around certificate pinning scenarios, where I'm particularly interested in the possibility of intercepting domain requests without necessarily accessing the request bodies. Essentially, I'm looking to identify which domains are being called, even in a pass-through context where the content of the communications remains encrypted or otherwise obscured. To this end, I contemplated developing an extension that would allow all traffic to pass through transparently but would still log the domains involved in the communications. However, I encountered a limitation with Burp Suite in that it seems to restrict interaction with domains listed for pass-through in its configuration. Is there any workaround that would enable this kind of domain tracking? Or would it be advisable to look into alternative tools for this specific functionality? Thanks, Alberto

Hannah, PortSwigger Agent | Last updated: Mar 20, 2024 11:44AM UTC

Hi Alberto If you have configured TLS Pass Through, then the request will bypass Burp's network stack. If you don't have TLS Pass Through configured, do you encounter issues with the application due to the certificate pinning? For alternative tools, WireShark can be useful for looking at network data. You may also want to take a look at Frida. There's also a BApp to help integrate Frida with Burp: https://portswigger.net/bappstore/2c0def96c5d44e159151b236de766892

Alberto | Last updated: Mar 20, 2024 01:27PM UTC