python - 如何使用 burp 套件代理 HTTPS 流量？

Question

我有一个网站:https://abs:8443/myweb我使用 burp suite 作为本地代理:

proxyIP = "127.0.0.1"
proxyPort = 8080

然后我尝试通过 burp 将 https 流量代理到 https 网站，但失败了。这是我尝试过的:

import sys
import socket
import ssl
import os

url = "https://abs:8443/myweb"
proxyIP = "127.0.0.1"
proxyPort = 8080
targetIP = "abs"
context = ssl.SSLContext(ssl.PROTOCOL_TLSv1)
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s_sock = context.wrap_socket(sock, server_hostname=targetIP)
s_sock.connect((proxyIP, proxyPort))

data = "some data"

payload = (
    "POST "+url+" HTTP/1.1\r\n"
    "Host: "+targetIP+":8443\r\n"
    "User-Agent: Mozilla/5.0 (X11; Linux i686; rv:52.0) Gecko/20100101 Firefox/52.0\r\n"
    "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n"
    "Accept-Language: en-US,en;q=0.5\r\n"
    "Accept-Encoding: gzip, deflate\r\n"
    "Content-Type: application/x-www-form-urlencoded\r\n"
    "Content-Length: "+str(len(data))+"\r\n"
    "\r\n" + data + "\r\n"
)

sock.sendall(payload)
recv = sock.recv(64000)
sock.close()
print recv

如何使用 burp suite 代理 HTTPS 流量？

Answer 1

您将需要一个普通的监听器，例如 127.0.0.1:8080 - 然后您必须安装 burp CA 证书，以便代理监听器能够协商 SSL 连接。

PortSwigger 为此编写了文档:

• > https://portswigger.net/burp/documentation/desktop/tools/proxy/options/installing-ca-certificate
• > https://support.portswigger.net/customer/portal/articles/1783075-installing-burp-s-ca-certificate-in-your-browser