Since Burp’s certificate is self-signed and untrusted by the browser, Chrome makes it obvious to the user that this isn’t a secure connection.īut what if we try to visit a site using HTTPS Strict Transport Security (HSTS), where the site requires that a secure connection is made between the server and the client? The image below shows an attempt to browse to Google while Burp is performing interception.Īs shown in the screen above, Chrome gives you no option to continue on to the untrusted site. This is because Burp breaks the certificate chain between the client and the server and uses its own certificate instead.

However, as shown in the address bar, the site is not considered secure. As shown below, we see the GET request for the requested website.įorwarding the requests in Burp eventually allows the webpage to load (as shown below). Under the Proxy → Intercept tab, you can see the requests as they move through. At this point, take a look at Burp Proxy. As a result, we see the warning below.Ĭlicking Advanced and Proceed to site allows us to actually visit the website. For this example, we’ve used an HTTPS site. When complete, click OK and attempt to browse to a website. If you’ve changed this information for your Burp Suite instance, use your modified values here. At the bottom of this screen is the computer’s proxy settings.Īs shown above, we’ve set the proxy settings for the computer to Burp Proxy’s default address and port (127.0.0.). In the above screen, click on the LAN settings button, which opens the screen below. As shown in the screen below, we’re using Windows for this example. In this example, we’re using Chrome, so these settings can be found by opening Options and searching for Proxy as shown below.Ĭlicking on the “Open proxy settings” button in the above screen opens up the computer’s Internet Settings.

If the proxy is running, the next step is setting up a Web browser to use the proxy. Note that the Burp proxy runs on 127.0.0.1:8080 by default. As shown in the screen above, this information is found under Proxy in the first row of tabs and Options in the second row.

When using Burp Suite as a proxy, it’s a good idea to ensure that the proxy is active. After installing and opening Burp Suite, you’ll see a screen similar to the one below. The Burp Suite Community Edition is available from PortSwigger. The first step to intercepting web traffic with Burp Suite is installing it on your system.

Burp proxy free download