Listen to this Post
Introduction:
In the high-stakes world of bug bounty hunting and web application penetration testing, visibility is everything. However, security professionals using Burp Suite often find their proxy history cluttered with thousands of irrelevant requests generated by the browser itself—updates, telemetry, and background syncs from services like Google and Mozilla. This “noise” obscures the actual traffic of the target application, slowing down analysis and potentially hiding critical vulnerabilities. By strategically configuring Burp Suite’s TLS Pass Through feature, testers can instruct the proxy to ignore specific domains, effectively filtering out the digital clutter and allowing them to focus exclusively on the attack surface that matters.
Learning Objectives:
- Understand the function of TLS Pass Through in Burp Suite and its role in traffic filtering.
- Learn to configure domain-specific patterns to exclude background browser noise.
- Master the creation of a clean, target-focused testing environment for efficient reconnaissance.
- Explore additional Burp Suite configurations and command-line tools to further optimize workflow.
You Should Know:
- Configuring TLS Pass Through to Silence Browser Background Noise
The core technique, as highlighted by security analyst Sada Devre, leverages Burp Suite’s TLS Pass Through feature. This setting prevents Burp from intercepting traffic destined for specified domains, allowing it to pass directly between the browser and the server without being logged or displayed in the HTTP history.
Step‑by‑step guide:
- Open Burp Suite and navigate to the Proxy tab.
2. Click on the Options sub-tab.
- Scroll down to the TLS Pass Through section.
- In the “Add” field, input the following regex patterns to block major sources of browser noise:
– `.\.google\.com` (Covers google.com, accounts.google.com, etc.)
– `.\.gstatic\.com` (Covers Google static content servers)
– `.\.googleapis\.com` (Covers Google API libraries)
– `.\.pki\.goog` (Covers Google Public Key Infrastructure)
– `.\.mozilla\..` (Covers Mozilla services like updates and sync)
– `.\.brave\..` (Covers Brave browser telemetry and rewards)
5. Click Add after each entry.
- Ensure the “Use TLS Pass Through for matching items” checkbox is selected.
- Verification: Open your browser, visit your target site, and then check the Proxy -> HTTP history tab. You should notice a dramatic reduction in entries, with most Google and browser-service traffic absent.
2. Creating a Laser-Focused Scope with Target Filters
While TLS Pass Through blocks traffic at the TLS handshake level, combining it with Burp’s Scope settings provides an additional layer of focus. This ensures that even if a request slips through, it can be visually filtered out.
Step‑by‑step guide:
- Switch to the Target tab and right-click on a relevant request from your target domain in the Site map.
- Select Add to Scope. Confirm by clicking Yes when prompted to stop logging out-of-scope items.
- To set a custom scope, go to the Target -> Scope tab. Here, you can define advanced rules using regex or simple domain names (e.g.,
.example.com). - Return to the Proxy -> HTTP history tab. Click the filter bar (usually a blue field saying “Show all” or similar).
- In the filter window, check the box for Show only in-scope items. Your history will now only display requests that match your defined target scope, completely ignoring everything else.
-
Hardening the Browser: Disabling Telemetry at the Source (Linux/Windows)
To reduce the upstream noise before it even reaches Burp, you can disable browser telemetry and services using system-level configurations. This is a form of application hardening that complements your proxy setup.
Linux (Disabling Google Chrome Telemetry):
You can launch Chrome with specific flags to disable background services:
google-chrome --disable-background-networking --disable-sync --disable-default-apps --no-first-run
For a more permanent solution, you can edit the `/etc/hosts` file to block telemetry domains:
sudo nano /etc/hosts
Add entries to redirect telemetry domains to localhost:
127.0.0.1 www.google-analytics.com 127.0.0.1 ssl.google-analytics.com 127.0.0.1 crashreports.google.com
Windows (PowerShell – Disabling Windows Services):
Windows itself generates significant background traffic. Use PowerShell (as Administrator) to disable diagnostic services:
Disable Windows DiagTrack (Connected User Experiences and Telemetry) Set-Service DiagTrack -StartupType Disabled Stop-Service DiagTrack Disable dmwappushservice (Device Management WAP Push) Set-Service dmwappushservice -StartupType Disabled Stop-Service dmwappushservice
Note: Disabling system services can impact functionality; ensure you are working in a dedicated testing VM.
4. API Security: Filtering Out Swagger/OpenAPI Noise
When testing APIs, Burp can become flooded with requests to documentation endpoints (like /swagger-ui/, /api-docs, /openapi.json). While important, you don’t need them cluttering your history while testing a specific endpoint.
Step‑by‑step guide using Burp Extender (Turbo Intruder/Logger++):
- Install the Logger++ extension from the BApp Store.
- Configure Logger++ with advanced filters to exclude requests based on URL path.
- For example, create a filter: `Exclude if URL Path contains`
swaggerorapi-docs. - This allows you to maintain a separate, clean log of API requests while keeping the main HTTP history for targeted testing.
5. Leveraging cURL and Proxychains for Command-Line Control
For advanced users, bypassing the browser entirely for certain requests can be the ultimate noise reduction strategy. Using command-line tools ensures you only send the requests you explicitly want.
Step‑by‑step guide (Linux):
- Ensure `proxychains` is installed (
sudo apt install proxychains4). - Configure proxychains to route traffic through Burp by editing
/etc/proxychains4.conf:sudo nano /etc/proxychains4.conf
At the bottom, ensure the proxy line is set to Burp’s listener:
http 127.0.0.1 8080
- Now, you can use `proxychains` with `curl` to send traffic through Burp while maintaining complete control over the request:
proxychains4 curl -X POST https://target-site.com/api/v1/login -H "Content-Type: application/json" -d '{"username":"test","password":"test"}'This sends only the exact API request through Burp, with zero browser noise.
6. Automating Cleanup with Burp Suite Extensions
For large-scale engagements, manual filtering isn’t enough. Extensions can automate the process of flagging or removing noise.
Step‑by‑step guide (Using CO2 or Custom Scripts):
- Install the CO2 extension from the BApp Store.
- CO2 includes a powerful “Advanced Scanner” and logging features, but its macro support can be used to script the removal of items from the history based on content type or domain.
- Alternatively, use the Burp Extender API with a Python (Jython) or Ruby script to listen for requests and drop them if they match a predefined noisy pattern (e.g.,
request.getUrl().toString().contains("doubleclick.net")).Example Jython snippet for a Burp extension from burp import IBurpExtender, IHttpListener class BurpExtender(IBurpExtender, IHttpListener): ... (initialization code) def processHttpMessage(self, toolFlag, messageIsRequest, messageInfo): if toolFlag == self.callbacks.TOOL_PROXY and not messageIsRequest: url = self.helpers.analyzeRequest(messageInfo).getUrl().toString() if "doubleclick.net" in url or "googleadservices.com" in url: messageInfo.setComment("[AUTO-DROPPED] Noise") Optionally mark for dropping
What Undercode Say:
- Optimization is a Force Multiplier: In cybersecurity, small workflow optimizations yield massive dividends. Filtering out browser noise isn’t just about convenience; it’s about cognitive focus. A cleaner workspace allows a tester to spot subtle injection points or logic flaws that would otherwise be lost in a sea of analytics traffic.
- Layered Defense for Workflow: The approach of combining TLS Pass Through, in-scope filtering, and browser hardening exemplifies a layered security mindset applied to the testing process itself. This holistic view ensures that the human element—the analyst—is protected from information overload, thereby increasing the quality of the security assessment.
Prediction:
As browsers become more complex and integrate deeper with cloud services (AI assistants, real-time syncing, Web3 features), the volume of background noise will only increase. Future penetration testing tools will likely incorporate machine learning to automatically classify and filter “noise” traffic, dynamically updating block lists based on community threat intelligence. We can predict that features like TLS Pass Through will evolve into more sophisticated “Traffic Shaping” modules, allowing testers to not just block, but categorize and visualize traffic in real-time, turning the proxy from a simple recorder into an intelligent analysis copilot.
▶️ Related Video (70% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Sada Devre – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
