Using Burp's Invisible Proxy Settings to Test a Non-Proxy-Aware Thick Client Application - Port Swigger
Summary: PortSwigger describes using Burp's invisible proxy listeners to test thick client applications that don't support HTTP proxies or offer an easy way to configure one. The technique redirects a non-proxy-aware client to Burp by modifying DNS resolution to point the hostname at 127.0.0.1, or by using DNAT to rewrite the destination address at the IP layer when DNS changes aren't possible.
What you should know: Thick clients and browser plugins that make their own HTTP requests outside the browser's framework often bypass the proxy settings security teams rely on, so traffic from these components can go uninspected unless a listener is set up to catch it.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026