Burpsuite Plugin to decrypt AES Encrypted traffic on the fly
NOTE: Currently support
$ git clone https://github.com/Ebryx/AES-Killer/ $ cd AES-Killer $ ./gradlew clean build
AES_Killer-Parameters.java: Let's say if application enforcing encryption on few parameters in request and these parameters will change every time with respect to endpoint/request so all you need to do is as follow
- Add endpoints by adding
this.endpoints.add("abc");in registerExtenderCallbacks function - Add parameters which will be encrypted in `String parameters` - Add rest of parameter in grant_type or make blank entry
and let the code do the magic for you.
AES_Killer_v3.0.java: This variant is generic and can deal with any type of request format i-e GET, POST(Form, JSON) with alternate parameters on different endpoints
- Clone the project and replace the BurpExtender.java with AES_Killer_v3.0.java code - Modify the endpoints and parameters of each request type in order as shown below - Update SecretKey and IV parameters and other required methods - Build the project and you are good to go
AES_Killer_v4.0.java: This variant is for Multi-Level encryption where application is encrypting few request parameters with one key and later on encrypting the whole request body with another key
- Clone the project and replace the BurpExtender.java with AES_Killer_v4.0.java code - Modify the endpoints and parameters as shown below - Update Secret Keys and other required methods - Build the project and add jar file to your extender
NOTE: These variants will not work for you directly due to nature of your request so might need little tweaking.
Download jar file from Release and add in burpsuite
Start AES Killer
Once we start AES Killer, it takes control of Burp
IHttpListener.processHttpMessage which is responsible for handling all outgoing and incoming traffic and AES Killer do the following
ProcessHttpMessageencrypt the request
ProcessHttpMessagedecrypt the response first before showing it to us
So we'll only be getting the Plain Text Response and can play with Plain Text request.
We can also manually encrypt and decrypt strings using AES Killer. Let's take an encrypted string from the request
TYROd49FWJjYBfv02oiUzwRQgxWMWiw4W3oCqvNf8h3bnb7X0bobypFzMt797CYU and decrypt it using AES Killer. Similarly, we can perform the encryption too.
Download Demo App from here