AES Killer (Burpsuite Plugin)

Burpsuite Plugin to decrypt AES Encrypted traffic on the fly

Requirements

• Burpsuite
• Java

Tested on

• Burpsuite 2021.4
• Windows 10
• Ubuntu & PopOS

What it does

• The IProxyListener decrypt requests and encrypt responses, and an IHttpListener than encrypt requests and decrypt responses.
• Burp sees the decrypted traffic, including Repeater, Intruder and Scanner, but the client/mobile app and server see the encrypted version.

NOTE: Currently support AES/CBC/PKCS5Padding && AES/ECB/PKCS5Padding encryption/decryption.

How it works

• Require AES Encryption Key (Can be obtained by using frida script or reversing mobile app)
• Require AES Encryption Initialize Vector (Can be obtained by using frida script or reversing mobile app)
• Request Parameter (Leave blank in case of whole request body)
• Response Parameter (Leave blank in case of whole response body)
• Character Separated with space for obfuscation on request/response (In case of Offuscation)
• URL/Host of target to decrypt/encrypt request and response

Variants

• AES_Killer for JSON request AES_Killer-JSON.java
• AES_Killer for random/alternate Parameters on different endpoints AES_Killer-Parameters.java

AES_Killer-Parameters.java: Let's say if application enforcing encryption on few parameters in request and these parameters will change every time with respect to endpoint/request so all you need to do is as follow

- Add endpoints by adding this.endpoints.add("abc"); in registerExtenderCallbacks function
- Add parameters which will be encrypted in `String[][] parameters`
- Add rest of parameter in grant_type or make blank entry

and let the code do the magic for you.

• AES_Killer_v3.0 a generic variant for alternate parameters on different endpoints with GET, POST (JSON, Form) support AES_Killer_v3.0.java

AES_Killer_v3.0.java: This variant is generic and can deal with any type of request format i-e GET, POST(Form, JSON) with alternate parameters on different endpoints

- Clone the project and replace the BurpExtender.java with AES_Killer_v3.0.java code
- Modify the endpoints and parameters of each request type in order as shown below
- Update SecretKey and IV parameters and other required methods
- Build the project and you are good to go

• AES_Killer_v4.0.java for multi-level encryption on request (Support Form, JSON and XML formats)

AES_Killer_v4.0.java: This variant is for Multi-Level encryption where application is encrypting few request parameters with one key and later on encrypting the whole request body with another key

- Clone the project and replace the BurpExtender.java with AES_Killer_v4.0.java code
- Modify the endpoints and parameters as shown below
- Update Secret Keys and other required methods
- Build the project and add jar file to your extender

NOTE: These variants will not work for you directly due to nature of your request so might need little tweaking.

How to Install

Download jar file from Release and add in burpsuite

Original Request/Response

Getting AES Encryption Key and IV

• First setup frida server on IOS and Android device.
• Launch Application on mobile device.
• Run this frida script on your host machine to get AES Encryption Key and IV.

Decrypt Request/Response

• Provide SecretSpecKey under Secret Key field
• Provide IV under Initialize Vector field
• Provide Host/URL to filter request and response for encryption and decryption
• Press Start AES Killer

Download Demo App from here