When a Web App Detects Burp Suite via TLS Fingerprinting

src/pentesting-web/proxy-waf-protections-bypass.md

@@ -143,6 +143,34 @@ http-request-smuggling/README.md
 file-upload/README.md
 {{#endref}}
 
+## TLS, JA3/JA4 and HTTP/2 fingerprint evasion
+
+An intercepting proxy creates two independent TLS sessions: browser-to-proxy and proxy-to-origin. The origin therefore fingerprints **Burp's outbound `ClientHello`**, not the browser's, while still receiving forwarded headers such as a Firefox or Chrome `User-Agent`. Bot controls can detect this cross-layer mismatch by correlating the TLS version, ordered cipher suites and extensions, ALPN, HTTP/2 `SETTINGS` and pseudo-header ordering, header ordering, and timing.<sup>[[14]](#references)</sup>
+
+JA3 summarizes ordered `ClientHello` fields, so changing only the `User-Agent` does not change the TLS identity. JA4 normalizes some unstable fields but the testing principle is the same: treat TLS, HTTP/2, headers, and behavior as one fingerprint rather than independent layers.<sup>[[14]](#references)</sup>
+
+### Shape Burp's server-facing connection
+
+The [Bypass Bot Detection BApp](https://portswigger.net/bappstore/50fd63182afe43b7a3cf99b523f313f9) changes Burp's server-facing network settings. Right-click a relevant request/response and open **Extensions -> Bypass bot detection**; current versions expose browser cipher profiles, an HTTP/2 downgrade, and brute-force probing.<sup>[[13]](#references)[[14]](#references)</sup>
+
+- **Browser profile:** select a Firefox, Chrome, or Safari profile matching the HTTP identity. The extension configures a shorter browser-shaped TLS protocol/cipher list and a corresponding `User-Agent`.
+- **HTTP/2 downgrade:** force HTTP/1.1 when the origin permits it, removing HTTP/2 `SETTINGS` and pseudo-header-order signals. TLS and HTTP/1 header/behavioral signals remain visible.
+- **Brute force:** replay selected requests with different TLS protocol/cipher combinations and flag response differences. This identifies cipher-sensitive scoring, not a universal bypass.
+
+The extension selects Burp's **Use custom protocols and ciphers** setting and brute-force mode changes network settings while it runs; do not run it concurrently with unrelated active scans. Cipher shaping also does **not** reproduce every byte of a real browser handshake, so extension order, supported groups, ALPN, timing, HTTP semantics, or behavioral telemetry may still reveal the proxy.<sup>[[13]](#references)[[14]](#references)</sup>
+
+### Verify instead of assuming
+
+Measure both the transport change and the application result.<sup>[[14]](#references)</sup>
+
+1. Record a direct-browser baseline with a fingerprint echo endpoint such as `https://tls.peet.ws/api/all`.
+2. Send the same request through Burp with the BApp disabled and save the reported ciphers, extensions, JA3/JA4, ALPN, and HTTP/2 fields.
+3. Apply the desired profile or downgrade and repeat the request.
+4. For byte-level confirmation, capture Burp's outbound `ClientHello` in Wireshark and diff cipher/extension ordering.
+5. Finally, repeat the authentication or session flow that was rejected. A changed hash proves only that the handshake changed; the target flow proves whether bot scoring changed.
+
+When comparing repeated TLS 1.3 connections, separate **full handshakes** from **resumed sessions**. A first connection may include extension `35` (`session_ticket`), while a resumed connection may replace it with extension `41` (`pre_shared_key`); that legitimate extension-list change also changes JA3. Use equivalent session state (or fresh sessions) before attributing a difference to the BApp.<sup>[[14]](#references)</sup>
+
 ## Generic WAF bypasses
 
 ### Request Size Limits
@@ -291,5 +319,7 @@ data:text/html;base64,PHN2Zy9vbmxvYWQ9YWxlcnQoMik+ #base64 encoding the javascri
 - [10] [#NahamCon2024: Modern WAF Bypass Techniques on Large Attack Surfaces](https://www.youtube.com/watch?v=0OMmWtU2Y_g)
 - [11] [swisskyrepo/PayloadsAllTheThings - PayloadsAllTheThings](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/XSS%20Injection/README.md#filter-bypass-and-exotic-payloads)
 - [12] [cheatsheetseries.owasp.org - OWASP](https://cheatsheetseries.owasp.org/cheatsheets/XSS_Filter_Evasion_Cheat_Sheet.html)
+- [13] [PortSwigger Bypass Bot Detection extension](https://github.com/PortSwigger/bypass-bot-detection)
+- [14] [When a Web App Detects Burp Suite via TLS Fingerprinting](https://kecman.co/blog/burp-suite-tls-fingerprint-bot-detection-bypass.html)
 
 {{#include ../banners/hacktricks-training.md}}