Using Burp with Containers In Docker

Making Docker Containers Trust Burp Suite’s CA for Testing

When testing applications running inside Docker containers, intercepting traffic with Burp Suite can be challenging because containers don’t automatically trust Burp’s CA certificate. Without trust, HTTPS requests from inside the container will fail with certificate errors.

In this post, I’ll show you how to:

1. Add Burp Suite’s CA to your host system
2. Pass the trusted CA to Docker containers
3. Ensure seamless HTTPS traffic interception for testing

Let’s get started!

HTTPSorHTTP

The Illusion of Web Security: A Cautionary Tale

Alex was a bright developer. Fresh out of college and eager to make a mark, he landed a job at a promising tech startup. His first major project: build a new web application for the company’s clients. As Alex dove into the world of code, he kept hearing the same advice from his peers and mentors: “Make sure the site uses HTTPS. It’s the gold standard for web security.”

https site available now with cert from cacert.org

More about cacert.org :

CAcert.org is a community-driven Certificate Authority that issues certificates to the public at large for free.

CAcert’s goal is to promote awareness and education on computer security through the use of encryption, specifically by providing cryptographic certificates. These certificates can be used to digitally sign and encrypt email, authenticate and authorize users connecting to websites and secure data transmission over the internet. Any application that supports the Secure Socket Layer Protocol (SSL or TLS) can make use of certificates signed by CAcert, as can any application that uses X.509 certificates, e.g. for encryption or code signing and document signatures.

Continue reading

CACert.org – get free ssl certificates.

From CACert website :

CAcert.org is a community-driven Certificate Authority that issues certificates to the public at large for free.

CAcert’s goal is to promote awareness and education on computer security through the use of encryption, specifically by providing cryptographic certificates. These certificates can be used to digitally sign and encrypt email, authenticate and authorize users connecting to websites and secure data transmission over the internet. Any application that supports the Secure Socket Layer Protocol (SSL or TLS) can make use of certificates signed by CAcert, as can any application that uses X.509 certificates, e.g. for encryption or code signing and document signatures.

Continue reading