How to Proxy IIS Express Traffic with Burp in Linux Guest VM (VMware)

I previously wrote about setting up a VirtualBox guest VM to allow Burp to proxy the HTTP traffic running in IIS Express for a .NET Framework app on the host. This article shows how to do the same in VMware Workstation Pro.

Allow External Requests to the Web App Running on the Host’s IIS Express

This part is no different than the VirtualBox set up, since it has to do with enabling external requests to the port where IIS Express is running the web app on the host.

1. Find and open the applicationhost.config file in the .vs folder of the web app you want to target. The path will be something like C:\...\.vs\YourWebApp\config\applicationhost.config
2. Locate the site node within the config file for the web app.
3. Add a wildcard binding similar to the following (with the actual port used by your web app): <binding protocol="http" bindingInformation="*:18321:*" />

The complete site node will look something like the following:

<site name="YourWebApp" id="1">
<application path="/" applicationPool="Clr4IntegratedAppPool">
<virtualDirectory path="/" physicalPath="C:\...\YourWebApp" />
</application>
<bindings>
<binding protocol="http" bindingInformation=":18321:localhost" />
<binding protocol="http" bindingInformation="*:18321:*" />
</bindings>
</site>

Test Your Connection to the IIS Express Web App on the Host

The steps here are identical to those for a guest VM running in VirtualBox, except for the target IP address used to access the web app on the host.

For VirtualBox this is 10.0.2.2:{port} by default. For VMware guest machines running in NAT network mode, you will need to run ipconfig on the Windows host to determine the IP address of vmnet1. See this discussion on StackOverflow for more details.