Feature Request

[deVirtuoso]

First thanks for sharing this tool with the community.

Any chance or suggestions for integrating the output or the program itself with Burpsuite or even this passing the critical output from Certmitm to Burp?

Ta
TO

[aapooksman]

Hey.

This would be a nice quality of life addition.

I have experimented a little with pushing the data to an upstream proxy such as burp, but have not got anything reliable to work.

The problem is that certmitm works on TCP and does not care about HTTP or any other protocol on top of it.

I would say there are two good options on hoq to implement this:

1. have the intercepted requests be constructed into HTTP using a python library and push that data through a HTTP proxy

2. Push the intercepted data directly through a TCP proxy. You can set up BURP to be an invisible proxy that does this. You need certmitm to try to connect to to the real server with TLS, but accept the BURP CA. Then you need to make an IPTABLES intercept rule or similar for these connections from certmitm to be redirected to BURP.

Feel free to discuss more if you figure out a better way than either of these, or start to implement one.

Happy to receive pull-requests for added features or fixes.

• aapo

[deVirtuoso]

I appreciate the prompt response aapo. Thanks for the direction.

You maybe please to hear prior to writing to you, I've been trying to get your second recommendation to work--using Burp as an invisible proxy with the appropriate certs including P#12 formats-- with little to no success with clearly vuln targets I've found.

BTW, the fact I was able to find these vulns were big wins on their own, so thanks again! I want to dig deeper before getting to excited, though.

I'll keep at it and also give option 1 a try.

Admittedly, I've gotten a bit distracted after I started look at one of your other projects on APNs ;)