How does burp-suite intercept https requeest inspite of the encryption?

user_11782743 0
Viewed 3227

I was trying to get myself familiarised with basic concepts of https when I came across its encryption, which in a nutshell functions as follows,

enter image description here

Now I have seen QA engineers in my company use this tool called burp-suite to intercept request.

What I am confused about is even though the data flows through an encrypted channel, how can any interception tool like burp-suite manage to intercept the request.

Just to try it out I tried to intercept facebook request in burp-suite,

enter image description here

Here you can clearly see the test email test@gmail.com I used in the intercepted request.

Why is this data not encrypted according to https standards?

Or if it is then how do burp-suite manage to decrypt it?

Thank you.

burp https ssl-certificate ssl
1 Answers

Meta: this isn't really a development or programming question or problem, although Burp is sometimes used for research or debugging.

If you LOOK AT THE DOCUMENTATION on Using Burp Proxy

Burp CA certificate - Since Burp breaks TLS connections between your browser and servers, your browser will by default show a warning message if you visit an HTTPS site via Burp Proxy. This is because the browser does not recognize Burp's TLS certificate, and infers that your traffic may be being intercepted by a third-party attacker. To use Burp effectively with TLS connections, you really need to install Burp's Certificate Authority master certificate in your browser, so that it trusts the certificates generated by Burp.

and following the link provided right there

By default, when you browse an HTTPS website via Burp, the Proxy generates a TLS certificate for each host, signed by its own Certificate Authority (CA) certificate. ...

Using its own generated cert (and matching key, although the webpage doesn't talk about that because it isn't visible to people) instead of the cert from the real site allows Burp to 'terminate' the TLS session from the client, decrypting and examining the data, and then forwarding that data over a different TLS session to the real site, and vice versa on the response (unless configured to do something different like modify the data).

... This CA certificate is generated the first time Burp is run, and stored locally. To use Burp Proxy most effectively with HTTPS websites, you will need to install Burp's CA certificate as a trusted root in your browser.

This is followed by a warning about the risks, and a link to instructions to do so.

Having its own CA cert trusted in the browser means that the generated cert is accepted by the browser and everything looks mostly normal to the browser user (or other client).

user_28688010
Related