Cyber security

Bypass Bot Detection – Enhancing Burp Suite With TLS Cipher Mutation

In the ever-evolving landscape of cybersecurity, staying ahead of detection mechanisms is crucial.

This article explores a Burp Suite extension that ingeniously mutates TLS ciphers to bypass TLS fingerprint-based bot detection.

Learn how to install and leverage this tool to enhance your security testing capabilities effectively.

Burp Suite extension that mutates ciphers to bypass TLS-fingerprint based bot detection

Usage

  1. Install the extension from Releases or build from sources.
  2. The extension changes network settings at Settings -> Network -> TLS and select Use custom protocols and cipher.
  3. Right-click on a Request/Response item in the Proxy History tab, navigate to Extensions -> Bypass bot detection, and select one of the menu items.
  4. If the server’s response changes (i.e., the number of words and headers are different), the extension will log the message and add notes to the Proxy History.

Build Instructions

  • Ensure that Java JDK 17 or newer is installed
  • From root of project, run the command ./gradlew jar
  • This should place the JAR file Bypass-Bot-Detection-0.0.1.jar within the build/libs directory
  • This can be loaded into Burp by navigating to the Extensions tab, Installed sub-tab, clicking Add and loading the JAR file
  • This BApp is using the newer Montoya API, so it’s best to use the latest version of Burp (try the earlier adopter channel if there are issues with the latest stable release)

Modes

  • Firefox Mode: Install the following list of cipher suites: 4865, 4867, 4866, 49195, 49199, 52393, 52392, 49196, 49200, 49162, 49161, 49171, 49172, 156, 157, 47, 53 and add the Firefox User-Agent header.
  • Chrome Mode: Use cipher suites 4865, 4866, 4867, 49195, 49199, 49196, 49200, 52393, 52392, 49171, 49172, 156, 157, 47, 53 and add the Chrome User-Agent header.
  • Safari Mode: Include cipher suites 4865, 4866, 4867, 49196, 49195, 52393, 49200, 49199, 52392, 49162, 49161, 49172, 49171, 157, 156, 53, 47, 49160, 49170, 10 and add the Safari User-Agent header.
  • Brute Force Mode: Tries different combinations of TLS protocol versions and cipher suites. For a full list, visit: PortSwigger/bypass-bot-detection.
Varshini

Varshini is a Cyber Security expert in Threat Analysis, Vulnerability Assessment, and Research. Passionate about staying ahead of emerging Threats and Technologies.

Recent Posts

Understanding the Model Context Protocol (MCP) and How It Works

Introduction to the Model Context Protocol (MCP) The Model Context Protocol (MCP) is an open…

14 hours ago

The file Command – Quickly Identify File Contents in Linux

While file extensions in Linux are optional and often misleading, the file command helps decode what a…

23 hours ago

How to Use the touch Command in Linux

The touch command is one of the quickest ways to create new empty files or update timestamps…

23 hours ago

How to Search Files and Folders in Linux Using the find Command

Handling large numbers of files is routine for Linux users, and that’s where the find command shines.…

24 hours ago

How to Move and Rename Files in Linux with the mv Command

Managing files and directories is foundational for Linux workflows, and the mv (“move”) command makes it easy…

24 hours ago

How to Create Directories in Linux with the mkdir Command

Creating directories is one of the earliest skills you'll use on a Linux system. The mkdir (make…

1 day ago