Skip to content

Bypass SSL check and Pass through Burp For NTLM Authentication #10

@restdone

Description

@restdone

I was testing an app which requires to skip SSL check and perform NTLM authentication through Burp Proxy on a Windows machine.

The SSL checking can be bypassed by appending $lwp ->ssl_opts(verify_hostname => 0,SSL_verify_mode => 0x00); after the following

  $lwp = LWP::UserAgent->new(env_proxy => 1,
                            keep_alive => 1,
                            timeout => 30,
                requests_redirectable => [],
                            );

I used the proxy option but somehow it was not working because the original code proxied the http traffic only, so I changed the code from

$lwp->proxy(['http'], "http://".$proxy);

to

$lwp->proxy('https', "http://127.0.0.1:8080");

so the https traffic would be proxied to burp.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions