新版Burpsuite加解密插件开发基础

我是CG

已于 2024-08-12 20:18:40 修改

阅读量1.5k

点赞数 26

文章标签：数据库

于 2024-08-12 19:55:54 首次发布

本文链接：https://blog.youkuaiyun.com/u014531320/article/details/141139684

版权

目前项目测试中总会遇到很多的加解密相关的请求和响应，由于早期的加解密插件不太好用，且目前加解密请求响应越来越普遍，因此就尝试自己写一个简单的burp加解密插件

环境基础

本次编写用到软件及平台有：Windows10+burpsuite_community24.5.3+IntelliJ IDEA Community Edition 2023.2.3+Visual Studio Code+nodejs1.18

本次涉及相关参考插件：xia.SQL.3.3.jdk16.jar+Galaxy加解密插件

IDEA配置

01 新建maven项目

02 maven配置pom.xml

<dependencies>

<!-- https://mvnrepository.com/artifact/net.portswigger.burp.extensions/montoya-api -->

<dependency>

<groupId>net.portswigger.burp.extensions</groupId>

<artifactId>montoya-api</artifactId>

<version>2023.12.1</version>

</dependency>

<!-- https://mvnrepository.com/artifact/com.alibaba.fastjson2/fastjson2 -->

<dependency>

<groupId>com.alibaba.fastjson2</groupId>

<artifactId>fastjson2</artifactId>

<version>2.0.51</version>

</dependency>

</dependencies>

新增对应的文件夹，并新增对应的初始化调用类：BurpExtender类

测试问题

测试发现的问题：对应的程序，默认请求全局加密，密钥放在请求头sign中，密钥和当前时间组合后做RSA加密，响应为json报文部分加密，具体如下

默认解决方法

测试发现对应的加解密使用了通用型加解密算法：AES/ECB/PKCS5Padding和RSA算法

具体实现脚本可以在对应的js脚本中找到

想要运行对应的js代码，需要使用Visual Studio Code和NodeJS进行联动才能运行指定的js代码

加解密算法

依据对应的加解密算法，尝试在网上找到对应的Java实现代码

AES-ECB算法

public class Encryptor {
    private static final String AES_ECB = "AES/ECB/PKCS5Padding";
    private static final Integer IV_LENGTH = 16;
    public static SecretKeySpec getSecretKeySpec(String key) {
        SecretKeySpec secretKeySpec = new SecretKeySpec(getBytes(key), "AES");
        return secretKeySpec;
    }
    public static byte[] getBytes(String str) {
        if (isEmpty(str)) {
            return null;
        }
        try {
            return str.getBytes(StandardCharsets.UTF_8);
        } catch (Exception e) {
            throw new RuntimeException(e);
        }
    }
    public static boolean isEmpty(Object str) {
        return null == str || "".equals(str);
    }

    public static String getIV() {
        Random random = new Random();
        StringBuffer sb = new StringBuffer();
        for (int i = 0; i < IV_LENGTH.intValue(); i++) {
 int number = random.nextInt("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789".length());
            sb.append("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789".charAt(number));
        }
        return sb.toString();
    }
    public static String encrypt(String text, String key) {
        if (isEmpty(text) || isEmpty(key)) {
            return null;
        }
        try {
            Cipher cipher = Cipher.getInstance("AES/ECB/PKCS5Padding");
            SecretKeySpec secretKeySpec = getSecretKeySpec(key);
            cipher.init(1, secretKeySpec);
            byte[] encryptedBytes = cipher.doFinal(getBytes(text));
            return Base64.getEncoder().encodeToString(encryptedBytes);
        } catch (Exception e) {
            throw new RuntimeException(e);
        }
    }
    public static String decrypt(String text, String key) {
        if (isEmpty(text) || isEmpty(key)) {
            return null;
        }
        byte[] textBytes = Base64.getDecoder().decode(text);
        try {
            Cipher cipher = Cipher.getInstance("AES/ECB/PKCS5Padding");
            SecretKeySpec secretKeySpec = getSecretKeySpec(key);
            cipher.init(2, secretKeySpec);
            byte[] decryptedBytes = cipher.doFinal(textBytes);
            return new String(decryptedBytes, StandardCharsets.UTF_8);
        } catch (Exception e) {
            throw new RuntimeException(e);
        }
    }
    public static void main(String[] args) {
        String key = "8****a";
        String test = "7***********=";
        String dff = decrypt(test, key);
        System.out.println(dff);
    }
}

RSA签名算法

public class RSACrypto {
    public static PublicKey getPublicKeyFromString(String publicKeyStr) throws Exception {
        byte[] keyBytes = Base64.getDecoder().decode(publicKeyStr);
        X509EncodedKeySpec keySpec = new X509EncodedKeySpec(keyBytes);
        KeyFactory keyFactory = KeyFactory.getInstance("RSA");
        return keyFactory.generatePublic(keySpec);
    }
    public static String encryptWithPublicKey(String publicKeyStr, String data) throws Exception {
        PublicKey publicKey = getPublicKeyFromString(publicKeyStr);
        Cipher cipher = Cipher.getInstance("RSA");
        cipher.init(Cipher.ENCRYPT_MODE, publicKey);
        byte[] encryptedBytes = cipher.doFinal(data.getBytes());
        return Base64.getEncoder().encodeToString(encryptedBytes);
    }
    public static void main(String[] args) {
        try {
            // 示例公钥，实际使用时需要替换为有效的公钥
            String publicKeyStr = "M************B";
            // 待加密的数据
            String data_time = String.valueOf(System.currentTimeMillis());
            String data = "b****t0_"+data_time;
            System.out.println("Date: " + data_time);
            String encryptedData = encryptWithPublicKey(publicKeyStr, data);
            System.out.println("Encrypted Data: " + encryptedData);
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
}

基于对应的算法，尝试开发burpsuite插件以便于测试

burp插件开发流程

开发需求

主要涉及如下信息：

burpsuite插件，需要有新的可输入内容的页面，在对应的页面中可以输入host白名单，输入aes_ecb对应的密钥

开发代码

拟定最终效果页面如下：

需要有对应的key输入位置，和设置白名单位置

初始化代码

初始化代码中使用本次涉及的三个类：burp使用三处核心类：registerRequestHandler，registerResponseHandler，registerHttpHandler

Package burp.api.montoya.proxy

registerRequestHandler，registerResponseHandler

Package burp.api.montoya.http

registerHttpHandler

montoyaApi.proxy().registerRequestHandler(new MyProxyRequestHandler(montoyaApi));

montoyaApi.proxy().registerResponseHandler(new MyProxyResponseHandler(montoyaApi));

montoyaApi.http().registerHttpHandler(new MyHttpHandler(montoyaApi));

设置对应的页面显示