AES-Killer is a Burp Suite extension designed to decrypt AES encrypted traffic on the fly. It intercepts HTTP messages, decrypting incoming requests and encrypting outgoing responses. To function, it requires the AES secret key and initialization vector (IV), which can be obtained using Frida scripting on target devices. The extension utilizes Frida to hook ProcessHttpMessage and modify the request and response handling process.
AES-Killer supports various AES encryption modes like CBC and ECB with PKCS5Padding. It offers variants for handling dynamic parameters on different endpoints, including GET, POST (Form and JSON), and XML formats. Furthermore, it has features for multi-level encryption allowing the application to encrypt requests in multiple stages. The extension provides a user-friendly interface within Burp Suite for easy configuration and operation.
- Traffic Interception: Decrypts incoming requests and encrypts outgoing responses in real-time.
- Frida Hooking: Uses Frida to obtain AES keys and IVs from target applications.
- Variant Support: Includes variants for dynamic parameters across various request types (GET, POST).
- Multi-level Encryption: Supports encrypting request bodies in multiple stages.
- User Interface: Provides an intuitive interface in Burp Suite for setup and operation.
- Flexible Configuration: Allows specifying URLs, selection of request/response actions and option selection to decrypt and encrypt.
- Manual Operation: Enables manual encryption/decryption of strings within Burp Suite.
The project is actively maintained, with recent commits indicating ongoing development and bug fixes. The documentation includes usage guides, installation instructions, and troubleshooting tips. The project also has a community presence through the GitHub repository and associated posts detailing usage with Frida. Regular releases with new features and variants suggest a commitment to improvement.
AES-Killer benefits security researchers and penetration testers by enabling the analysis of encrypted communication within Burp Suite. It's valuable for auditing applications utilizing AES encryption, bypassing security measures, or understanding communication protocols. It allows users to inspect plaintext data without requiring server-side decryption or manual data extraction.