When a Web App Detects Burp Suite via TLS Fingerprinting

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://kecman.co/blog/burp-suite-tls-fingerprint-bot-detection-bypass.html
• Blog Title: When a Web App Detects Burp Suite via TLS Fingerprinting
• Suggested Section: Pentesting Web > Proxy / WAF Protections Bypass > TLS, JA3/JA4, and HTTP/2 Fingerprint Evasion with Burp Suite

🎯 Content Summary

Overview

The post explains how bot-management systems can detect traffic intercepted by Burp Suite by comparing the browser identity claimed at the HTTP layer with the TLS and HTTP/2 fingerprints observed on the connection. This is not an application vulnerability: it is a defensive anti-automation capability and a potential testing artifact. During an authorized assessment, however, modifying Burp's outbound fingerprint can prevent bot scoring from silently rejecting proxied requests...

🔧 Technical Details

Detecting proxy/header inconsistencies: A TLS-intercepting proxy creates independent client-facing and server-facing TLS sessions. The destination sees HTTP headers copied from the browser but fingerprints the proxy's own outbound ClientHello. Comparing the claimed browser identity with JA3/JA4, cipher and extension ordering, ALPN, HTTP/2 SETTINGS, pseudo-header ordering, header ordering, and handshake timing can identify interception or automation even when the HTTP request itself appears browser-generated.

Shaping a proxy's outbound TLS fingerprint: Reconfigure the server-facing TLS stack to advertise a short, modern, browser-like cipher list instead of a large library-default list containing legacy suites. In Burp, right-click the scoped host and use Extensions → Bypass Bot Detection → Adjust ciphers to common browsers. This modifies connection #2 and can improve risk-based bot score...

🤖 Agent Actions

Updated src/pentesting-web/proxy-waf-protections-bypass.md with:

• Burp’s two-session TLS fingerprint mismatch.
• JA3/JA4 and HTTP/2 fingerprint evasion.
• Bypass Bot Detection BApp browser profiles, downgrade, and brute-force modes.
• Fingerprint verification workflow.
• TLS 1.3 session-resumption caveat.
• Numbered citations to PortSwigger’s primary source and the supplied blog.

Validation:

• git diff --check passed.
• All added URLs return HTTP 200.
• No forbidden sources were added.
• Only the intended file changed.
• mdbook build was unavailable because mdbook is not installed.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://kecman.co/blog/burp-suite-tls-fingerprint-bot-detection-bypass.html

Content Categories: Based on the analysis, this content was categorized under "Pentesting Web > Proxy / WAF Protections Bypass > TLS, JA3/JA4, and HTTP/2 Fingerprint Evasion with Burp Suite".

Repository Maintenance:

• MD Files Formatting: 988 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0