Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

tls termination

Andrew | Last updated: Jan 16, 2019 08:04AM UTC

Hi, Can burp do tls/ssl termination? That is to say, I want to test a site using HTTPS but one of the systems loaded in an iframe does not support HTTPS yet and I get mixed content errors in Chrome. While I would like burp to proxy the HTTPS request, terminate the TLS/SSL and pass the request on as plain HTTP to the backend, package the response using Burp's certificate and give it to Chrome. I only want this done for one specific subsystem domain.

PortSwigger Agent | Last updated: Jan 16, 2019 10:22AM UTC

Yes, you can do this. There is two steps: 1) Install the Target Redirector extension. This lets you redirect incoming HTTPS to outgoing HTTP for a specific host name. You can checks that https://foo.com is accessible in your browser. 2) The iframe src will still be http. You can add a match and replace rule to rewrite this. Look in Proxy > Options > Match and Replace

Burp User | Last updated: Jan 16, 2019 01:01PM UTC