top of page

Why Burpsuite is able to capture https traffic?

Burpsuite is an integrated, user-interface proxy tool which is used to perform security testing of web applications or websites. It is used to analyze, find and exploit vulnerabilities in web applications.


  • After configuring the burpsuite in the browser by installing the SSL certificate signed by its own CA, now burp is ready to capture the https traffic, which means decrypting an encrypted communication. For example: able to capture sensitive data like username/password over an encrypted channel.

  • As burp is using its own self-signed certificate instead of certificate from a website which allows the proxy tool burpsuite to terminate the TLS/SSL session from the client, decrypt and examine the data, and then forward the request to the website. This means burpsuite acts as a website for the client or browser.

  • Now, it act as same when server/website responds and send the data to client, first it is captured by burpsuite which has its own SSL certificate which is used to decrypt the data. The website expects that the request is coming from the genuine browser and then forwards the response to the client or browser. This also implies that complete ssl handshake happened during the process of encryption and decryption of data transmits between client-burpuite, burpsuite-server and vice versa.





Helpful resources:

How to configure burpsuite:


0 views

Recent Posts

See All
bottom of page