- Unsupervised Learning
- Posts
- Testing HSTS-protected Sites Using Burp
Testing HSTS-protected Sites Using Burp
If you do a lot of web assessments using Burp (or any proxy, really) you might be having issues with HSTS-enabled sites.
The issue is with modern browsers (especially recently) being very strict with who you can and cannot talk to. Basically, before they were just warning you that something could be dangerous, but now they’re simply not allowing you to visit the site at all.
So here are two solutions:
Use a browser that gives 0 f*cks
Install Burp’s CA as a root certificate into your browser
The first just avoids the problem because the browser isn’t looking for, or enforcing, the HSTS check. The second forces the browser to trust Burp.