SSL pass through in Burp
Summary: PortSwigger added an SSL pass through feature to Burp Suite that lets users specify destination web servers where Burp Proxy passes SSL connections straight through without breaking the tunnel. The feature is aimed at cases where client-side SSL errors are hard to eliminate, such as mobile applications that perform SSL certificate pinning, and Burp notes that traffic on passed-through connections will not appear in the Proxy intercept view or history.
Bottom line: PortSwigger advises against generally enabling the automatic addition of pass through servers, because a one-off negotiation failure will stop Burp from intercepting SSL connections to that host until the server is manually removed from the list.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026