PyCript v0.3 releases: Burp Suite extension that allows for bypassing client-side encryption
PyCript
The Pycript extension for Burp Suite is a valuable tool for penetration testing and security professionals. It enables easy encryption and decryption of requests during testing, which can help evade detection and bypass security measures. The extension also offers the ability to customize the encryption and decryption process by writing custom logic using JavaScript and Node.js, making it a highly adaptable tool for various needs. Additionally, it supports both manual and automated testing, as well as custom encryption/decryption plugins, making it a versatile solution for different penetration testing scenarios.
Features
- Encrypt & Decrypt the Selected Strings from Request Response
- View and Modify the encrypted request in plain text
- Decrypt Multiple Requests
- Perform Burp Scanner, Sql Map, Intruder Bruteforce, or any Automation in Plain Text
- Auto Encrpyt the request on the fly
- Complete freedom for encryption and decryption logic
- Ability to handle encryption and decryption even with Key and IV in Request Header or Body
The flow of the Extension
- Load the Encryption and Decryption JavaScript File in the extension
- Select the Request Type according to your request and encryption
- Add the URL in Burp Suite Scope
- Go to Repeater, Proxy Intercept, Proxy History, Intruder, Target
- You can see a new tab in the request message named PyCript
- If everything is setup correctly and the extension is given the correct encryption decryption code you see the decrypted text
- Edit the decrypted text and send the request
- The extension will take care of the encryption of your modified value
Changelog v0.3
- Fixed an error in Mac OS M1 and M2 that was caused by direct subprocess execution. Special thanks to Tavi for reporting the issue in the extension.
- Added a logger to aid in debugging the encryption and decryption background process.
- Implemented a new way to include or exclude parameters for encryption and decryption in requests and responses, thanks to Parimal Shaw for the feature idea.
- Improved the speed of PyCript compared to older versions.
- The PyCript editor tab now works more efficiently for both requests and responses at the same time.
- Added a new resource option to help users get started with PyCript.
- Custom requests can now take headers in base64 encoded format.
- The decrypted request table now allows for deleting entries. Special thanks to Akshay Dandekar for the feature idea.
- Fixed a bug where the response encryption file was being replaced with the request encryption file from local storage.
- Optimized the code to make PyCript more efficient.
- Fixed a bug where the PyCript editor tab would show an error and get stuck when handling plain text requests or error scripts.
- Fixed an issue where invalid or empty requests or responses would cause Burp Suite to freeze in the decrypted request table.
Install & Use
Copyright (c) 2022 AnoF
