Showing posts with label Pentesting. Show all posts
Showing posts with label Pentesting. Show all posts

Tuesday, November 10, 2015

How to fix slow HTTPS traffic in Burp Suite, while inspecting mobile app traffic

Whenever I have to look into HTTPS mobile traffic through burp suite, the traffic is extremely slow and it eats a lot of my precious time. Someone already posted about the issue on the burp suite forum 2 years ago, and the admins said they'll look in to it, but it doesn't seem to be fixed as of today.

In the meantime, here's a quick fix. Just put some other proxy in front of the burp proxy, and the traffic flow is a lot smoother. The proxy could be any tool, be it Zap, fiddler, charles proxy and the like.

So it goes like this.

[ Mobile device ] -> [ ZAP ] -> [ Burp Suite ] -> [ Mobile app server on the web ]

Pretty simple huh?

Don't forget to install the foremost (ZAP in the above case) proxy certificate on the mobile device.