Giter VIP home page Giter VIP logo

whwlsfb / burpcrypto Goto Github PK

View Code? Open in Web Editor NEW
1.4K 1.4K 168.0 11.22 MB

BurpCrypto is a collection of burpsuite encryption plug-ins, support AES/RSA/DES/ExecJs(execute JS encryption code in burpsuite). 支持多种加密算法或直接执行JS代码的用于爆破前端加密的BurpSuite插件

Home Page: https://blog.wanghw.cn/burpcrypto

License: MIT License

Java 100.00%
burp-extensions burp-plugin burpcrypto burpsuite burpsuite-extender ctf ctf-tools execute-js-encryption fuzz-testing payloads

burpcrypto's People

Contributors

fossabot avatar whwlsfb avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

burpcrypto's Issues

burp v2020.4.1 加密后的string依然是plain text , 用的是latest release

window={};
navigator={};
document={};

function rsa_pwd(content) {
  //十六进制公钥
  var rsa_n = "8bcbceb956d3d6c0da8cd8847e50796eac0fb3d67d4901820fa85dcd8edbb30bd25966eb18223e1ace1308da181897df4559bf97cca6ae9a33a0baf6f53324334a385d2a7cbc186fb5070045080b6c948423e7ddcd795ac9eaa438317772f4a948409ecec92dfe222a10b4c327e8d0e494cc0aa42ebc786030a105da0637049d";
  var rsa = new RSAKey();
  rsa.setPublic(rsa_n, "10001");
  var content_rsa = rsa.encrypt(content);
  if (content_rsa == null) {
    return content;
  }
  return content_rsa;
}


function RSAKey() {
  this.n = null;
  this.e = 0;
  this.d = null;
  this.p = null;
  this.q = null;
  this.dmp1 = null;
  this.dmq1 = null;
  this.coeff = null;
}

function getResult(pass) {
  return new rsa_pwd(pass).getValue()
}


// Depends on jsbn.js and rng.js

// Version 1.1: support utf-8 encoding in pkcs1pad2

// convert a (hex) string to a bignum object
function parseBigInt(str,r) {
  return new BigInteger(str,r);
}

function linebrk(s,n) {
  var ret = "";
  var i = 0;
  while(i + n < s.length) {
    ret += s.substring(i,i+n) + "\n";
    i += n;
  }
  return ret + s.substring(i,s.length);
}

function byte2Hex(b) {
  if(b < 0x10)
    return "0" + b.toString(16);
  else
    return b.toString(16);
}

// PKCS#1 (type 2, random) pad input string s to n bytes, and return a bigint
function pkcs1pad2(s,n) {
  if(n < s.length + 11) { // TODO: fix for utf-8
  if (window.console) {
    console.log("Message too long for RSA");
  } else {
    alert("Message too long for RSA");
  }
    return null;
  }
  var ba = new Array();
  var i = s.length - 1;
  while(i >= 0 && n > 0) {
    var c = s.charCodeAt(i--);
    if(c < 128) { // encode using utf-8
      ba[--n] = c;
    }
    else if((c > 127) && (c < 2048)) {
      ba[--n] = (c & 63) | 128;
      ba[--n] = (c >> 6) | 192;
    }
    else {
      ba[--n] = (c & 63) | 128;
      ba[--n] = ((c >> 6) & 63) | 128;
      ba[--n] = (c >> 12) | 224;
    }
  }
  ba[--n] = 0;
  var rng = new SecureRandom();
  var x = new Array();
  while(n > 2) { // random non-zero pad
    x[0] = 0;
    while(x[0] == 0) rng.nextBytes(x);
    ba[--n] = x[0];
  }
  ba[--n] = 2;
  ba[--n] = 0;
  return new BigInteger(ba);
}

// "empty" RSA key constructor
function RSAKey() {
  this.n = null;
  this.e = 0;
  this.d = null;
  this.p = null;
  this.q = null;
  this.dmp1 = null;
  this.dmq1 = null;
  this.coeff = null;
}

// Set the public key fields N and e from hex strings
function RSASetPublic(N,E) {
  if(N != null && E != null && N.length > 0 && E.length > 0) {
    this.n = parseBigInt(N,16);
    this.e = parseInt(E,16);
  }
  else {
    if (window.console) {
      console.log("Invalid RSA public key");
    } else {
      alert("Invalid RSA public key");
    }
  }
}

// Perform raw public operation on "x": return x^e (mod n)
function RSADoPublic(x) {
  return x.modPowInt(this.e, this.n);
}

// Return the PKCS#1 RSA encryption of "text" as an even-length hex string
function RSAEncrypt(text) {
  var m = pkcs1pad2(text,(this.n.bitLength()+7)>>3);
  if(m == null) return null;
  var c = this.doPublic(m);
  if(c == null) return null;
  var h = c.toString(16);
  if((h.length & 1) == 0) return h; else return "0" + h;
}

// Return the PKCS#1 RSA encryption of "text" as a Base64-encoded string
//function RSAEncryptB64(text) {
//  var h = this.encrypt(text);
//  if(h) return hex2b64(h); else return null;
//}

// protected
RSAKey.prototype.doPublic = RSADoPublic;

// public
RSAKey.prototype.setPublic = RSASetPublic;
RSAKey.prototype.encrypt = RSAEncrypt;
//RSAKey.prototype.encrypt_b64 = RSAEncryptB64;



// Depends on jsbn.js and rng.js

// Version 1.1: support utf-8 encoding in pkcs1pad2

// convert a (hex) string to a bignum object
function parseBigInt(str,r) {
  return new BigInteger(str,r);
}

function linebrk(s,n) {
  var ret = "";
  var i = 0;
  while(i + n < s.length) {
    ret += s.substring(i,i+n) + "\n";
    i += n;
  }
  return ret + s.substring(i,s.length);
}

function byte2Hex(b) {
  if(b < 0x10)
    return "0" + b.toString(16);
  else
    return b.toString(16);
}

// PKCS#1 (type 2, random) pad input string s to n bytes, and return a bigint
function pkcs1pad2(s,n) {
  if(n < s.length + 11) { // TODO: fix for utf-8
  if (window.console) {
    console.log("Message too long for RSA");
  } else {
    alert("Message too long for RSA");
  }
    return null;
  }
  var ba = new Array();
  var i = s.length - 1;
  while(i >= 0 && n > 0) {
    var c = s.charCodeAt(i--);
    if(c < 128) { // encode using utf-8
      ba[--n] = c;
    }
    else if((c > 127) && (c < 2048)) {
      ba[--n] = (c & 63) | 128;
      ba[--n] = (c >> 6) | 192;
    }
    else {
      ba[--n] = (c & 63) | 128;
      ba[--n] = ((c >> 6) & 63) | 128;
      ba[--n] = (c >> 12) | 224;
    }
  }
  ba[--n] = 0;
  var rng = new SecureRandom();
  var x = new Array();
  while(n > 2) { // random non-zero pad
    x[0] = 0;
    while(x[0] == 0) rng.nextBytes(x);
    ba[--n] = x[0];
  }
  ba[--n] = 2;
  ba[--n] = 0;
  return new BigInteger(ba);
}

// "empty" RSA key constructor
function RSAKey() {
  this.n = null;
  this.e = 0;
  this.d = null;
  this.p = null;
  this.q = null;
  this.dmp1 = null;
  this.dmq1 = null;
  this.coeff = null;
}

// Set the public key fields N and e from hex strings
function RSASetPublic(N,E) {
  if(N != null && E != null && N.length > 0 && E.length > 0) {
    this.n = parseBigInt(N,16);
    this.e = parseInt(E,16);
  }
  else {
    if (window.console) {
      console.log("Invalid RSA public key");
    } else {
      alert("Invalid RSA public key");
    }
  }
}

// Perform raw public operation on "x": return x^e (mod n)
function RSADoPublic(x) {
  return x.modPowInt(this.e, this.n);
}

// Return the PKCS#1 RSA encryption of "text" as an even-length hex string
function RSAEncrypt(text) {
  var m = pkcs1pad2(text,(this.n.bitLength()+7)>>3);
  if(m == null) return null;
  var c = this.doPublic(m);
  if(c == null) return null;
  var h = c.toString(16);
  if((h.length & 1) == 0) return h; else return "0" + h;
}

// Return the PKCS#1 RSA encryption of "text" as a Base64-encoded string
//function RSAEncryptB64(text) {
//  var h = this.encrypt(text);
//  if(h) return hex2b64(h); else return null;
//}

// protected
RSAKey.prototype.doPublic = RSADoPublic;

// public
RSAKey.prototype.setPublic = RSASetPublic;
RSAKey.prototype.encrypt = RSAEncrypt;
//RSAKey.prototype.encrypt_b64 = RSAEncryptB64;



var path = "../";//path路径从引入js时传入
var scArr = document.getElementsByTagName('script');
for (var i = scArr.length - 1; i >= 0; i--) {
  var script = scArr[i];
  if (script.src.indexOf("rsa.pwd.public.js") > -1) {
    if (script.src.split('?')[1] == undefined) {
      break;
    }
    var paramsArr = script.src.split('?')[1].split('&');
    if (paramsArr.length > 0) {
      var paramTmp = paramsArr[0].split('=');
      var value = paramTmp[1];
      if (value != undefined) {
        path = value;
      }
    }
    break;
  }
}

document.write('<script language="JavaScript" type="text/javascript" src="' + path + 'commons/js/rsa/jsbn.js"></script>');
document.write('<script language="JavaScript" type="text/javascript" src="' + path + 'commons/js/rsa/prng4.js"></script>');
document.write('<script language="JavaScript" type="text/javascript" src="' + path + 'commons/js/rsa/rng.js"></script>');
document.write('<script language="JavaScript" type="text/javascript" src="' + path + 'commons/js/rsa/rsa.js"></script>');

function rsa_pwd(content) {
  //十六进制公钥
  var rsa_n = "8bcbceb956d3d6c0da8cd8847e50796eac0fb3d67d4901820fa85dcd8edbb30bd25966eb18223e1ace1308da181897df4559bf97cca6ae9a33a0baf6f53324334a385d2a7cbc186fb5070045080b6c948423e7ddcd795ac9eaa438317772f4a948409ecec92dfe222a10b4c327e8d0e494cc0aa42ebc786030a105da0637049d";
  var rsa = new RSAKey();
  rsa.setPublic(rsa_n, "10001");
  var content_rsa = rsa.encrypt(content);
  if (content_rsa == null) {
    return content;
  }
  return content_rsa;
}


// Random number generator - requires a PRNG backend, e.g. prng4.js

// For best results, put code like
// <body onClick='rng_seed_time();' onKeyPress='rng_seed_time();'>
// in your main HTML document.

var rng_state;
var rng_pool;
var rng_pptr;

// Mix in a 32-bit integer into the pool
function rng_seed_int(x) {
  rng_pool[rng_pptr++] ^= x & 255;
  rng_pool[rng_pptr++] ^= (x >> 8) & 255;
  rng_pool[rng_pptr++] ^= (x >> 16) & 255;
  rng_pool[rng_pptr++] ^= (x >> 24) & 255;
  if(rng_pptr >= rng_psize) rng_pptr -= rng_psize;
}

// Mix in the current time (w/milliseconds) into the pool
function rng_seed_time() {
  rng_seed_int(new Date().getTime());
}

// Initialize the pool with junk if needed.
if(rng_pool == null) {
  rng_pool = new Array();
  rng_pptr = 0;
  var t;
  if(window.crypto && window.crypto.getRandomValues) {
    // Use webcrypto if available
    var ua = new Uint8Array(32);
    window.crypto.getRandomValues(ua);
    for(t = 0; t < 32; ++t)
      rng_pool[rng_pptr++] = ua[t];
  }
  if(navigator.appName == "Netscape" && navigator.appVersion < "5" && window.crypto) {
    // Extract entropy (256 bits) from NS4 RNG if available
    var z = window.crypto.random(32);
    for(t = 0; t < z.length; ++t)
      rng_pool[rng_pptr++] = z.charCodeAt(t) & 255;
  }  
  while(rng_pptr < rng_psize) {  // extract some randomness from Math.random()
    t = Math.floor(65536 * Math.random());
    rng_pool[rng_pptr++] = t >>> 8;
    rng_pool[rng_pptr++] = t & 255;
  }
  rng_pptr = 0;
  rng_seed_time();
  //rng_seed_int(window.screenX);
  //rng_seed_int(window.screenY);
}

function rng_get_byte() {
  if(rng_state == null) {
    rng_seed_time();
    rng_state = prng_newstate();
    rng_state.init(rng_pool);
    for(rng_pptr = 0; rng_pptr < rng_pool.length; ++rng_pptr)
      rng_pool[rng_pptr] = 0;
    rng_pptr = 0;
    //rng_pool = null;
  }
  // TODO: allow reseeding after first request
  return rng_state.next();
}

function rng_get_bytes(ba) {
  var i;
  for(i = 0; i < ba.length; ++i) ba[i] = rng_get_byte();
}

function SecureRandom() {}

SecureRandom.prototype.nextBytes = rng_get_bytes;


// Copyright (c) 2005  Tom Wu
// All Rights Reserved.
// See "LICENSE" for details.

// Basic JavaScript BN library - subset useful for RSA encryption.

// Bits per digit
var dbits;

// JavaScript engine analysis
var canary = 0xdeadbeefcafe;
var j_lm = ((canary&0xffffff)==0xefcafe);

// (public) Constructor
function BigInteger(a,b,c) {
  if(a != null)
    if("number" == typeof a) this.fromNumber(a,b,c);
    else if(b == null && "string" != typeof a) this.fromString(a,256);
    else this.fromString(a,b);
}

// return new, unset BigInteger
function nbi() { return new BigInteger(null); }

// am: Compute w_j += (x*this_i), propagate carries,
// c is initial carry, returns final carry.
// c < 3*dvalue, x < 2*dvalue, this_i < dvalue
// We need to select the fastest one that works in this environment.

// am1: use a single mult and divide to get the high bits,
// max digit bits should be 26 because
// max internal value = 2*dvalue^2-2*dvalue (< 2^53)
function am1(i,x,w,j,c,n) {
  while(--n >= 0) {
    var v = x*this[i++]+w[j]+c;
    c = Math.floor(v/0x4000000);
    w[j++] = v&0x3ffffff;
  }
  return c;
}
// am2 avoids a big mult-and-extract completely.
// Max digit bits should be <= 30 because we do bitwise ops
// on values up to 2*hdvalue^2-hdvalue-1 (< 2^31)
function am2(i,x,w,j,c,n) {
  var xl = x&0x7fff, xh = x>>15;
  while(--n >= 0) {
    var l = this[i]&0x7fff;
    var h = this[i++]>>15;
    var m = xh*l+h*xl;
    l = xl*l+((m&0x7fff)<<15)+w[j]+(c&0x3fffffff);
    c = (l>>>30)+(m>>>15)+xh*h+(c>>>30);
    w[j++] = l&0x3fffffff;
  }
  return c;
}
// Alternately, set max digit bits to 28 since some
// browsers slow down when dealing with 32-bit numbers.
function am3(i,x,w,j,c,n) {
  var xl = x&0x3fff, xh = x>>14;
  while(--n >= 0) {
    var l = this[i]&0x3fff;
    var h = this[i++]>>14;
    var m = xh*l+h*xl;
    l = xl*l+((m&0x3fff)<<14)+w[j]+c;
    c = (l>>28)+(m>>14)+xh*h;
    w[j++] = l&0xfffffff;
  }
  return c;
}
if(j_lm && (navigator.appName == "Microsoft Internet Explorer")) {
  BigInteger.prototype.am = am2;
  dbits = 30;
}
else if(j_lm && (navigator.appName != "Netscape")) {
  BigInteger.prototype.am = am1;
  dbits = 26;
}
else { // Mozilla/Netscape seems to prefer am3
  BigInteger.prototype.am = am3;
  dbits = 28;
}

BigInteger.prototype.DB = dbits;
BigInteger.prototype.DM = ((1<<dbits)-1);
BigInteger.prototype.DV = (1<<dbits);

var BI_FP = 52;
BigInteger.prototype.FV = Math.pow(2,BI_FP);
BigInteger.prototype.F1 = BI_FP-dbits;
BigInteger.prototype.F2 = 2*dbits-BI_FP;

// Digit conversions
var BI_RM = "0123456789abcdefghijklmnopqrstuvwxyz";
var BI_RC = new Array();
var rr,vv;
rr = "0".charCodeAt(0);
for(vv = 0; vv <= 9; ++vv) BI_RC[rr++] = vv;
rr = "a".charCodeAt(0);
for(vv = 10; vv < 36; ++vv) BI_RC[rr++] = vv;
rr = "A".charCodeAt(0);
for(vv = 10; vv < 36; ++vv) BI_RC[rr++] = vv;

function int2char(n) { return BI_RM.charAt(n); }
function intAt(s,i) {
  var c = BI_RC[s.charCodeAt(i)];
  return (c==null)?-1:c;
}

// (protected) copy this to r
function bnpCopyTo(r) {
  for(var i = this.t-1; i >= 0; --i) r[i] = this[i];
  r.t = this.t;
  r.s = this.s;
}

// (protected) set from integer value x, -DV <= x < DV
function bnpFromInt(x) {
  this.t = 1;
  this.s = (x<0)?-1:0;
  if(x > 0) this[0] = x;
  else if(x < -1) this[0] = x+this.DV;
  else this.t = 0;
}

// return bigint initialized to value
function nbv(i) { var r = nbi(); r.fromInt(i); return r; }

// (protected) set from string and radix
function bnpFromString(s,b) {
  var k;
  if(b == 16) k = 4;
  else if(b == 8) k = 3;
  else if(b == 256) k = 8; // byte array
  else if(b == 2) k = 1;
  else if(b == 32) k = 5;
  else if(b == 4) k = 2;
  else { this.fromRadix(s,b); return; }
  this.t = 0;
  this.s = 0;
  var i = s.length, mi = false, sh = 0;
  while(--i >= 0) {
    var x = (k==8)?s[i]&0xff:intAt(s,i);
    if(x < 0) {
      if(s.charAt(i) == "-") mi = true;
      continue;
    }
    mi = false;
    if(sh == 0)
      this[this.t++] = x;
    else if(sh+k > this.DB) {
      this[this.t-1] |= (x&((1<<(this.DB-sh))-1))<<sh;
      this[this.t++] = (x>>(this.DB-sh));
    }
    else
      this[this.t-1] |= x<<sh;
    sh += k;
    if(sh >= this.DB) sh -= this.DB;
  }
  if(k == 8 && (s[0]&0x80) != 0) {
    this.s = -1;
    if(sh > 0) this[this.t-1] |= ((1<<(this.DB-sh))-1)<<sh;
  }
  this.clamp();
  if(mi) BigInteger.ZERO.subTo(this,this);
}

// (protected) clamp off excess high words
function bnpClamp() {
  var c = this.s&this.DM;
  while(this.t > 0 && this[this.t-1] == c) --this.t;
}

// (public) return string representation in given radix
function bnToString(b) {
  if(this.s < 0) return "-"+this.negate().toString(b);
  var k;
  if(b == 16) k = 4;
  else if(b == 8) k = 3;
  else if(b == 2) k = 1;
  else if(b == 32) k = 5;
  else if(b == 4) k = 2;
  else return this.toRadix(b);
  var km = (1<<k)-1, d, m = false, r = "", i = this.t;
  var p = this.DB-(i*this.DB)%k;
  if(i-- > 0) {
    if(p < this.DB && (d = this[i]>>p) > 0) { m = true; r = int2char(d); }
    while(i >= 0) {
      if(p < k) {
        d = (this[i]&((1<<p)-1))<<(k-p);
        d |= this[--i]>>(p+=this.DB-k);
      }
      else {
        d = (this[i]>>(p-=k))&km;
        if(p <= 0) { p += this.DB; --i; }
      }
      if(d > 0) m = true;
      if(m) r += int2char(d);
    }
  }
  return m?r:"0";
}

// (public) -this
function bnNegate() { var r = nbi(); BigInteger.ZERO.subTo(this,r); return r; }

// (public) |this|
function bnAbs() { return (this.s<0)?this.negate():this; }

// (public) return + if this > a, - if this < a, 0 if equal
function bnCompareTo(a) {
  var r = this.s-a.s;
  if(r != 0) return r;
  var i = this.t;
  r = i-a.t;
  if(r != 0) return (this.s<0)?-r:r;
  while(--i >= 0) if((r=this[i]-a[i]) != 0) return r;
  return 0;
}

// returns bit length of the integer x
function nbits(x) {
  var r = 1, t;
  if((t=x>>>16) != 0) { x = t; r += 16; }
  if((t=x>>8) != 0) { x = t; r += 8; }
  if((t=x>>4) != 0) { x = t; r += 4; }
  if((t=x>>2) != 0) { x = t; r += 2; }
  if((t=x>>1) != 0) { x = t; r += 1; }
  return r;
}

// (public) return the number of bits in "this"
function bnBitLength() {
  if(this.t <= 0) return 0;
  return this.DB*(this.t-1)+nbits(this[this.t-1]^(this.s&this.DM));
}

// (protected) r = this << n*DB
function bnpDLShiftTo(n,r) {
  var i;
  for(i = this.t-1; i >= 0; --i) r[i+n] = this[i];
  for(i = n-1; i >= 0; --i) r[i] = 0;
  r.t = this.t+n;
  r.s = this.s;
}

// (protected) r = this >> n*DB
function bnpDRShiftTo(n,r) {
  for(var i = n; i < this.t; ++i) r[i-n] = this[i];
  r.t = Math.max(this.t-n,0);
  r.s = this.s;
}

// (protected) r = this << n
function bnpLShiftTo(n,r) {
  var bs = n%this.DB;
  var cbs = this.DB-bs;
  var bm = (1<<cbs)-1;
  var ds = Math.floor(n/this.DB), c = (this.s<<bs)&this.DM, i;
  for(i = this.t-1; i >= 0; --i) {
    r[i+ds+1] = (this[i]>>cbs)|c;
    c = (this[i]&bm)<<bs;
  }
  for(i = ds-1; i >= 0; --i) r[i] = 0;
  r[ds] = c;
  r.t = this.t+ds+1;
  r.s = this.s;
  r.clamp();
}

// (protected) r = this >> n
function bnpRShiftTo(n,r) {
  r.s = this.s;
  var ds = Math.floor(n/this.DB);
  if(ds >= this.t) { r.t = 0; return; }
  var bs = n%this.DB;
  var cbs = this.DB-bs;
  var bm = (1<<bs)-1;
  r[0] = this[ds]>>bs;
  for(var i = ds+1; i < this.t; ++i) {
    r[i-ds-1] |= (this[i]&bm)<<cbs;
    r[i-ds] = this[i]>>bs;
  }
  if(bs > 0) r[this.t-ds-1] |= (this.s&bm)<<cbs;
  r.t = this.t-ds;
  r.clamp();
}

// (protected) r = this - a
function bnpSubTo(a,r) {
  var i = 0, c = 0, m = Math.min(a.t,this.t);
  while(i < m) {
    c += this[i]-a[i];
    r[i++] = c&this.DM;
    c >>= this.DB;
  }
  if(a.t < this.t) {
    c -= a.s;
    while(i < this.t) {
      c += this[i];
      r[i++] = c&this.DM;
      c >>= this.DB;
    }
    c += this.s;
  }
  else {
    c += this.s;
    while(i < a.t) {
      c -= a[i];
      r[i++] = c&this.DM;
      c >>= this.DB;
    }
    c -= a.s;
  }
  r.s = (c<0)?-1:0;
  if(c < -1) r[i++] = this.DV+c;
  else if(c > 0) r[i++] = c;
  r.t = i;
  r.clamp();
}

// (protected) r = this * a, r != this,a (HAC 14.12)
// "this" should be the larger one if appropriate.
function bnpMultiplyTo(a,r) {
  var x = this.abs(), y = a.abs();
  var i = x.t;
  r.t = i+y.t;
  while(--i >= 0) r[i] = 0;
  for(i = 0; i < y.t; ++i) r[i+x.t] = x.am(0,y[i],r,i,0,x.t);
  r.s = 0;
  r.clamp();
  if(this.s != a.s) BigInteger.ZERO.subTo(r,r);
}

// (protected) r = this^2, r != this (HAC 14.16)
function bnpSquareTo(r) {
  var x = this.abs();
  var i = r.t = 2*x.t;
  while(--i >= 0) r[i] = 0;
  for(i = 0; i < x.t-1; ++i) {
    var c = x.am(i,x[i],r,2*i,0,1);
    if((r[i+x.t]+=x.am(i+1,2*x[i],r,2*i+1,c,x.t-i-1)) >= x.DV) {
      r[i+x.t] -= x.DV;
      r[i+x.t+1] = 1;
    }
  }
  if(r.t > 0) r[r.t-1] += x.am(i,x[i],r,2*i,0,1);
  r.s = 0;
  r.clamp();
}

// (protected) divide this by m, quotient and remainder to q, r (HAC 14.20)
// r != q, this != m.  q or r may be null.
function bnpDivRemTo(m,q,r) {
  var pm = m.abs();
  if(pm.t <= 0) return;
  var pt = this.abs();
  if(pt.t < pm.t) {
    if(q != null) q.fromInt(0);
    if(r != null) this.copyTo(r);
    return;
  }
  if(r == null) r = nbi();
  var y = nbi(), ts = this.s, ms = m.s;
  var nsh = this.DB-nbits(pm[pm.t-1]);  // normalize modulus
  if(nsh > 0) { pm.lShiftTo(nsh,y); pt.lShiftTo(nsh,r); }
  else { pm.copyTo(y); pt.copyTo(r); }
  var ys = y.t;
  var y0 = y[ys-1];
  if(y0 == 0) return;
  var yt = y0*(1<<this.F1)+((ys>1)?y[ys-2]>>this.F2:0);
  var d1 = this.FV/yt, d2 = (1<<this.F1)/yt, e = 1<<this.F2;
  var i = r.t, j = i-ys, t = (q==null)?nbi():q;
  y.dlShiftTo(j,t);
  if(r.compareTo(t) >= 0) {
    r[r.t++] = 1;
    r.subTo(t,r);
  }
  BigInteger.ONE.dlShiftTo(ys,t);
  t.subTo(y,y); // "negative" y so we can replace sub with am later
  while(y.t < ys) y[y.t++] = 0;
  while(--j >= 0) {
    // Estimate quotient digit
    var qd = (r[--i]==y0)?this.DM:Math.floor(r[i]*d1+(r[i-1]+e)*d2);
    if((r[i]+=y.am(0,qd,r,j,0,ys)) < qd) {  // Try it out
      y.dlShiftTo(j,t);
      r.subTo(t,r);
      while(r[i] < --qd) r.subTo(t,r);
    }
  }
  if(q != null) {
    r.drShiftTo(ys,q);
    if(ts != ms) BigInteger.ZERO.subTo(q,q);
  }
  r.t = ys;
  r.clamp();
  if(nsh > 0) r.rShiftTo(nsh,r);  // Denormalize remainder
  if(ts < 0) BigInteger.ZERO.subTo(r,r);
}

// (public) this mod a
function bnMod(a) {
  var r = nbi();
  this.abs().divRemTo(a,null,r);
  if(this.s < 0 && r.compareTo(BigInteger.ZERO) > 0) a.subTo(r,r);
  return r;
}

// Modular reduction using "classic" algorithm
function Classic(m) { this.m = m; }
function cConvert(x) {
  if(x.s < 0 || x.compareTo(this.m) >= 0) return x.mod(this.m);
  else return x;
}
function cRevert(x) { return x; }
function cReduce(x) { x.divRemTo(this.m,null,x); }
function cMulTo(x,y,r) { x.multiplyTo(y,r); this.reduce(r); }
function cSqrTo(x,r) { x.squareTo(r); this.reduce(r); }

Classic.prototype.convert = cConvert;
Classic.prototype.revert = cRevert;
Classic.prototype.reduce = cReduce;
Classic.prototype.mulTo = cMulTo;
Classic.prototype.sqrTo = cSqrTo;

// (protected) return "-1/this % 2^DB"; useful for Mont. reduction
// justification:
//         xy == 1 (mod m)
//         xy =  1+km
//   xy(2-xy) = (1+km)(1-km)
// x[y(2-xy)] = 1-k^2m^2
// x[y(2-xy)] == 1 (mod m^2)
// if y is 1/x mod m, then y(2-xy) is 1/x mod m^2
// should reduce x and y(2-xy) by m^2 at each step to keep size bounded.
// JS multiply "overflows" differently from C/C++, so care is needed here.
function bnpInvDigit() {
  if(this.t < 1) return 0;
  var x = this[0];
  if((x&1) == 0) return 0;
  var y = x&3;    // y == 1/x mod 2^2
  y = (y*(2-(x&0xf)*y))&0xf;  // y == 1/x mod 2^4
  y = (y*(2-(x&0xff)*y))&0xff;  // y == 1/x mod 2^8
  y = (y*(2-(((x&0xffff)*y)&0xffff)))&0xffff; // y == 1/x mod 2^16
  // last step - calculate inverse mod DV directly;
  // assumes 16 < DB <= 32 and assumes ability to handle 48-bit ints
  y = (y*(2-x*y%this.DV))%this.DV;    // y == 1/x mod 2^dbits
  // we really want the negative inverse, and -DV < y < DV
  return (y>0)?this.DV-y:-y;
}

// Montgomery reduction
function Montgomery(m) {
  this.m = m;
  this.mp = m.invDigit();
  this.mpl = this.mp&0x7fff;
  this.mph = this.mp>>15;
  this.um = (1<<(m.DB-15))-1;
  this.mt2 = 2*m.t;
}

// xR mod m
function montConvert(x) {
  var r = nbi();
  x.abs().dlShiftTo(this.m.t,r);
  r.divRemTo(this.m,null,r);
  if(x.s < 0 && r.compareTo(BigInteger.ZERO) > 0) this.m.subTo(r,r);
  return r;
}

// x/R mod m
function montRevert(x) {
  var r = nbi();
  x.copyTo(r);
  this.reduce(r);
  return r;
}

// x = x/R mod m (HAC 14.32)
function montReduce(x) {
  while(x.t <= this.mt2)  // pad x so am has enough room later
    x[x.t++] = 0;
  for(var i = 0; i < this.m.t; ++i) {
    // faster way of calculating u0 = x[i]*mp mod DV
    var j = x[i]&0x7fff;
    var u0 = (j*this.mpl+(((j*this.mph+(x[i]>>15)*this.mpl)&this.um)<<15))&x.DM;
    // use am to combine the multiply-shift-add into one call
    j = i+this.m.t;
    x[j] += this.m.am(0,u0,x,i,0,this.m.t);
    // propagate carry
    while(x[j] >= x.DV) { x[j] -= x.DV; x[++j]++; }
  }
  x.clamp();
  x.drShiftTo(this.m.t,x);
  if(x.compareTo(this.m) >= 0) x.subTo(this.m,x);
}

// r = "x^2/R mod m"; x != r
function montSqrTo(x,r) { x.squareTo(r); this.reduce(r); }

// r = "xy/R mod m"; x,y != r
function montMulTo(x,y,r) { x.multiplyTo(y,r); this.reduce(r); }

Montgomery.prototype.convert = montConvert;
Montgomery.prototype.revert = montRevert;
Montgomery.prototype.reduce = montReduce;
Montgomery.prototype.mulTo = montMulTo;
Montgomery.prototype.sqrTo = montSqrTo;

// (protected) true iff this is even
function bnpIsEven() { return ((this.t>0)?(this[0]&1):this.s) == 0; }

// (protected) this^e, e < 2^32, doing sqr and mul with "r" (HAC 14.79)
function bnpExp(e,z) {
  if(e > 0xffffffff || e < 1) return BigInteger.ONE;
  var r = nbi(), r2 = nbi(), g = z.convert(this), i = nbits(e)-1;
  g.copyTo(r);
  while(--i >= 0) {
    z.sqrTo(r,r2);
    if((e&(1<<i)) > 0) z.mulTo(r2,g,r);
    else { var t = r; r = r2; r2 = t; }
  }
  return z.revert(r);
}

// (public) this^e % m, 0 <= e < 2^32
function bnModPowInt(e,m) {
  var z;
  if(e < 256 || m.isEven()) z = new Classic(m); else z = new Montgomery(m);
  return this.exp(e,z);
}

// protected
BigInteger.prototype.copyTo = bnpCopyTo;
BigInteger.prototype.fromInt = bnpFromInt;
BigInteger.prototype.fromString = bnpFromString;
BigInteger.prototype.clamp = bnpClamp;
BigInteger.prototype.dlShiftTo = bnpDLShiftTo;
BigInteger.prototype.drShiftTo = bnpDRShiftTo;
BigInteger.prototype.lShiftTo = bnpLShiftTo;
BigInteger.prototype.rShiftTo = bnpRShiftTo;
BigInteger.prototype.subTo = bnpSubTo;
BigInteger.prototype.multiplyTo = bnpMultiplyTo;
BigInteger.prototype.squareTo = bnpSquareTo;
BigInteger.prototype.divRemTo = bnpDivRemTo;
BigInteger.prototype.invDigit = bnpInvDigit;
BigInteger.prototype.isEven = bnpIsEven;
BigInteger.prototype.exp = bnpExp;

// public
BigInteger.prototype.toString = bnToString;
BigInteger.prototype.negate = bnNegate;
BigInteger.prototype.abs = bnAbs;
BigInteger.prototype.compareTo = bnCompareTo;
BigInteger.prototype.bitLength = bnBitLength;
BigInteger.prototype.mod = bnMod;
BigInteger.prototype.modPowInt = bnModPowInt;

// "constants"
BigInteger.ZERO = nbv(0);
BigInteger.ONE = nbv(1);



// prng4.js - uses Arcfour as a PRNG

function Arcfour() {
  this.i = 0;
  this.j = 0;
  this.S = new Array();
}

// Initialize arcfour context from key, an array of ints, each from [0..255]
function ARC4init(key) {
  var i, j, t;
  for(i = 0; i < 256; ++i)
    this.S[i] = i;
  j = 0;
  for(i = 0; i < 256; ++i) {
    j = (j + this.S[i] + key[i % key.length]) & 255;
    t = this.S[i];
    this.S[i] = this.S[j];
    this.S[j] = t;
  }
  this.i = 0;
  this.j = 0;
}

function ARC4next() {
  var t;
  this.i = (this.i + 1) & 255;
  this.j = (this.j + this.S[this.i]) & 255;
  t = this.S[this.i];
  this.S[this.i] = this.S[this.j];
  this.S[this.j] = t;
  return this.S[(t + this.S[this.i]) & 255];
}

Arcfour.prototype.init = ARC4init;
Arcfour.prototype.next = ARC4next;

// Plug in your RNG constructor here
function prng_newstate() {
  return new Arcfour();
}

// Pool size must be a multiple of 4 and greater than 32.
// An array of bytes the size of the pool will be passed to init()
var rng_psize = 256;


/**
 *create by 2012-08-25 pm 17:48
 *@author [email protected]
 *http://code.google.com/p/lazycode/
 *BASE64 Encode and Decode By UTF-8 unicode
 *可以和java的BASE64编码和解码互相转化
 */
(function() {
  var BASE64_MAPPING = [ 'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'I', 'J',
      'K', 'L', 'M', 'N', 'O', 'P', 'Q', 'R', 'S', 'T', 'U', 'V', 'W',
      'X', 'Y', 'Z', 'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j',
      'k', 'l', 'm', 'n', 'o', 'p', 'q', 'r', 's', 't', 'u', 'v', 'w',
      'x', 'y', 'z', '0', '1', '2', '3', '4', '5', '6', '7', '8', '9',
      '+', '/' ];

  /**
   *ascii convert to binary
   */
  var _toBinary = function(ascii) {
    var binary = new Array();
    while (ascii > 0) {
      var b = ascii % 2;
      ascii = Math.floor(ascii / 2);
      binary.push(b);
    }
    /*
    var len = binary.length;
    if(6-len > 0){
      for(var i = 6-len ; i > 0 ; --i){
        binary.push(0);
      }
    }*/
    binary.reverse();
    return binary;
  };

  /**
   *binary convert to decimal
   */
  var _toDecimal = function(binary) {
    var dec = 0;
    var p = 0;
    for (var i = binary.length - 1; i >= 0; --i) {
      var b = binary[i];
      if (b == 1) {
        dec += Math.pow(2, p);
      }
      ++p;
    }
    return dec;
  };

  /**
   *unicode convert to utf-8
   */
  var _toUTF8Binary = function(c, binaryArray) {
    var mustLen = (8 - (c + 1)) + ((c - 1) * 6);
    var fatLen = binaryArray.length;
    var diff = mustLen - fatLen;
    while (--diff >= 0) {
      binaryArray.unshift(0);
    }
    var binary = [];
    var _c = c;
    while (--_c >= 0) {
      binary.push(1);
    }
    binary.push(0);
    var i = 0, len = 8 - (c + 1);
    for (; i < len; ++i) {
      binary.push(binaryArray[i]);
    }

    for (var j = 0; j < c - 1; ++j) {
      binary.push(1);
      binary.push(0);
      var sum = 6;
      while (--sum >= 0) {
        binary.push(binaryArray[i++]);
      }
    }
    return binary;
  };

  var __BASE64 = {
    /**
     *BASE64 Encode
     */
    encoder : function(str) {
      var base64_Index = [];
      var binaryArray = [];
      for (var i = 0, len = str.length; i < len; ++i) {
        var unicode = str.charCodeAt(i);
        var _tmpBinary = _toBinary(unicode);
        if (unicode < 0x80) {
          var _tmpdiff = 8 - _tmpBinary.length;
          while (--_tmpdiff >= 0) {
            _tmpBinary.unshift(0);
          }
          binaryArray = binaryArray.concat(_tmpBinary);
        } else if (unicode >= 0x80 && unicode <= 0x7FF) {
          binaryArray = binaryArray.concat(_toUTF8Binary(2,
              _tmpBinary));
        } else if (unicode >= 0x800 && unicode <= 0xFFFF) {//UTF-8 3byte
          binaryArray = binaryArray.concat(_toUTF8Binary(3,
              _tmpBinary));
        } else if (unicode >= 0x10000 && unicode <= 0x1FFFFF) {//UTF-8 4byte
          binaryArray = binaryArray.concat(_toUTF8Binary(4,
              _tmpBinary));
        } else if (unicode >= 0x200000 && unicode <= 0x3FFFFFF) {//UTF-8 5byte
          binaryArray = binaryArray.concat(_toUTF8Binary(5,
              _tmpBinary));
        } else if (unicode >= 4000000 && unicode <= 0x7FFFFFFF) {//UTF-8 6byte
          binaryArray = binaryArray.concat(_toUTF8Binary(6,
              _tmpBinary));
        }
      }

      var extra_Zero_Count = 0;
      for (var i = 0, len = binaryArray.length; i < len; i += 6) {
        var diff = (i + 6) - len;
        if (diff == 2) {
          extra_Zero_Count = 2;
        } else if (diff == 4) {
          extra_Zero_Count = 4;
        }
        //if(extra_Zero_Count > 0){
        //  len += extra_Zero_Count+1;
        //}
        var _tmpExtra_Zero_Count = extra_Zero_Count;
        while (--_tmpExtra_Zero_Count >= 0) {
          binaryArray.push(0);
        }
        base64_Index.push(_toDecimal(binaryArray.slice(i, i + 6)));
      }

      var base64 = '';
      for (var i = 0, len = base64_Index.length; i < len; ++i) {
        base64 += BASE64_MAPPING[base64_Index[i]];
      }

      for (var i = 0, len = extra_Zero_Count / 2; i < len; ++i) {
        base64 += '=';
      }
      return base64;
    },
    /**
     *BASE64  Decode for UTF-8 
     */
    decoder : function(str) {
      var c1, c2, c3, c4;
      var base64DecodeChars = new Array(-1, -1, -1, -1, -1, -1, -1, -1,
          -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
          -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
          -1, -1, -1, -1, -1, 62, -1, -1, -1, 63, 52, 53, 54, 55, 56,
          57, 58, 59, 60, 61, -1, -1, -1, -1, -1, -1, -1, 0, 1, 2, 3,
          4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19,
          20, 21, 22, 23, 24, 25, -1, -1, -1, -1, -1, -1, 26, 27, 28,
          29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43,
          44, 45, 46, 47, 48, 49, 50, 51, -1, -1, -1, -1, -1);
      var i = 0, len = str.length, string = '';

      while (i < len) {
        do {
          c1 = base64DecodeChars[str.charCodeAt(i++) & 0xff]
        } while (i < len && c1 == -1);

        if (c1 == -1)
          break;

        do {
          c2 = base64DecodeChars[str.charCodeAt(i++) & 0xff]
        } while (i < len && c2 == -1);

        if (c2 == -1)
          break;

        string += String.fromCharCode((c1 << 2) | ((c2 & 0x30) >> 4));

        do {
          c3 = str.charCodeAt(i++) & 0xff;
          if (c3 == 61)
            return string;

          c3 = base64DecodeChars[c3]
        } while (i < len && c3 == -1);

        if (c3 == -1)
          break;

        string += String.fromCharCode(((c2 & 0XF) << 4)
            | ((c3 & 0x3C) >> 2));

        do {
          c4 = str.charCodeAt(i++) & 0xff;
          if (c4 == 61)
            return string;
          c4 = base64DecodeChars[c4]
        } while (i < len && c4 == -1);

        if (c4 == -1)
          break;

        string += String.fromCharCode(((c3 & 0x03) << 6) | c4)
      }
      return string
    }
  };

  window.BASE64 = __BASE64;
})();

上面是js代码,

burp 2023 0302 java 11 error

java.lang.IllegalArgumentException: Database directory 'BurpCrypto.ldb' does not exist and could not be created
	at com.google.common.base.Preconditions.checkArgument(Preconditions.java:191)
	at org.iq80.leveldb.impl.DbImpl.<init>(DbImpl.java:163)
	at org.iq80.leveldb.impl.Iq80DBFactory.open(Iq80DBFactory.java:83)
	at burp.BurpExtender.registerExtenderCallbacks(BurpExtender.java:97)
	at burp.Zzv0.ZS(Unknown Source)
	at burp.Ze8n.ZF(Unknown Source)
	at burp.Ze8b.lambda$initialiseOnNewThread$0(Unknown Source)
	at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:577)
	at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:317)
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144)
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642)
	at java.base/java.lang.Thread.run(Thread.java:1589)

功能建议:爆破结果显示原始payload

爆破结果显示原始payload,当前功能是框选密文后右键解密,当成功结果过多时(数十个以上)对比原始payload过于复杂,可否在intruder模块中直接显示

在EXEC JS seting 如何调用如下函数?

/**

/*

  • encrypt the string to string made up of hex

  • return the encrypted string
    */
    function strEnc(data, firstKey, secondKey, thirdKey) {

    var leng = data.length;
    var encData = "";
    var firstKeyBt, secondKeyBt, thirdKeyBt, firstLength, secondLength, thirdLength;
    if (firstKey != null && firstKey != "") {
    firstKeyBt = getKeyBytes(firstKey);
    firstLength = firstKeyBt.length;
    }
    if (secondKey != null && secondKey != "") {
    secondKeyBt = getKeyBytes(secondKey);
    secondLength = secondKeyBt.length;
    }
    if (thirdKey != null && thirdKey != "") {
    thirdKeyBt = getKeyBytes(thirdKey);
    thirdLength = thirdKeyBt.length;
    }

    if (leng > 0) {
    if (leng < 4) {
    var bt = strToBt(data);
    var encByte;
    if (firstKey != null && firstKey != "" && secondKey != null && secondKey != "" && thirdKey != null && thirdKey != "") {
    var tempBt;
    var x, y, z;
    tempBt = bt;
    for (x = 0; x < firstLength; x++) {
    tempBt = enc(tempBt, firstKeyBt[x]);
    }
    for (y = 0; y < secondLength; y++) {
    tempBt = enc(tempBt, secondKeyBt[y]);
    }
    for (z = 0; z < thirdLength; z++) {
    tempBt = enc(tempBt, thirdKeyBt[z]);
    }
    encByte = tempBt;
    } else {
    if (firstKey != null && firstKey != "" && secondKey != null && secondKey != "") {
    var tempBt;
    var x, y;
    tempBt = bt;
    for (x = 0; x < firstLength; x++) {
    tempBt = enc(tempBt, firstKeyBt[x]);
    }
    for (y = 0; y < secondLength; y++) {
    tempBt = enc(tempBt, secondKeyBt[y]);
    }
    encByte = tempBt;
    } else {
    if (firstKey != null && firstKey != "") {
    var tempBt;
    var x = 0;
    tempBt = bt;
    for (x = 0; x < firstLength; x++) {
    tempBt = enc(tempBt, firstKeyBt[x]);
    }
    encByte = tempBt;
    }
    }
    }
    encData = bt64ToHex(encByte);
    } else {
    var iterator = parseInt(leng / 4);
    var remainder = leng % 4;
    var i = 0;
    for (i = 0; i < iterator; i++) {
    var tempData = data.substring(i * 4 + 0, i * 4 + 4);
    var tempByte = strToBt(tempData);
    var encByte;
    if (firstKey != null && firstKey != "" && secondKey != null && secondKey != "" && thirdKey != null && thirdKey != "") {
    var tempBt;
    var x, y, z;
    tempBt = tempByte;
    for (x = 0; x < firstLength; x++) {
    tempBt = enc(tempBt, firstKeyBt[x]);
    }
    for (y = 0; y < secondLength; y++) {
    tempBt = enc(tempBt, secondKeyBt[y]);
    }
    for (z = 0; z < thirdLength; z++) {
    tempBt = enc(tempBt, thirdKeyBt[z]);
    }
    encByte = tempBt;
    } else {
    if (firstKey != null && firstKey != "" && secondKey != null && secondKey != "") {
    var tempBt;
    var x, y;
    tempBt = tempByte;
    for (x = 0; x < firstLength; x++) {
    tempBt = enc(tempBt, firstKeyBt[x]);
    }
    for (y = 0; y < secondLength; y++) {
    tempBt = enc(tempBt, secondKeyBt[y]);
    }
    encByte = tempBt;
    } else {
    if (firstKey != null && firstKey != "") {
    var tempBt;
    var x;
    tempBt = tempByte;
    for (x = 0; x < firstLength; x++) {
    tempBt = enc(tempBt, firstKeyBt[x]);
    }
    encByte = tempBt;
    }
    }
    }
    encData += bt64ToHex(encByte);
    }
    if (remainder > 0) {
    var remainderData = data.substring(iterator * 4 + 0, leng);
    var tempByte = strToBt(remainderData);
    var encByte;
    if (firstKey != null && firstKey != "" && secondKey != null && secondKey != "" && thirdKey != null && thirdKey != "") {
    var tempBt;
    var x, y, z;
    tempBt = tempByte;
    for (x = 0; x < firstLength; x++) {
    tempBt = enc(tempBt, firstKeyBt[x]);
    }
    for (y = 0; y < secondLength; y++) {
    tempBt = enc(tempBt, secondKeyBt[y]);
    }
    for (z = 0; z < thirdLength; z++) {
    tempBt = enc(tempBt, thirdKeyBt[z]);
    }
    encByte = tempBt;
    } else {
    if (firstKey != null && firstKey != "" && secondKey != null && secondKey != "") {
    var tempBt;
    var x, y;
    tempBt = tempByte;
    for (x = 0; x < firstLength; x++) {
    tempBt = enc(tempBt, firstKeyBt[x]);
    }
    for (y = 0; y < secondLength; y++) {
    tempBt = enc(tempBt, secondKeyBt[y]);
    }
    encByte = tempBt;
    } else {
    if (firstKey != null && firstKey != "") {
    var tempBt;
    var x;
    tempBt = tempByte;
    for (x = 0; x < firstLength; x++) {
    tempBt = enc(tempBt, firstKeyBt[x]);
    }
    encByte = tempBt;
    }
    }
    }
    encData += bt64ToHex(encByte);
    }
    }
    }
    return encData;
    }

在其他位置,又有如下:
$("#rsa").val(strEnc(u + p + b, '1', '2', '3'));
u + p + b 对应如上面函数参数的data ,1、2、3对应firstkey、secondkey、thirdkey

此函数如何在EXEC JS seting 调用呢?

DES密钥过长导致error

des-ecb密钥过长会导致加密error,虽然后来我发现des密钥只取8位,自己把密钥缩短能成功加密,也希望插件能自动截断8位后的密钥吧,或者直接设置一个长度限制?

没有pkcs7

比如des-ecb pkcs7没有这个padding怎么办

使用exec js编写 aes 加密 解密,rsa加密方法

网站加密方式为请求包响应包为 aes加密,在请求请求体中有rsa加签,现在可以实现请求包的加密,解密,生成签名;但是响应包调用解密算法,cipherText result弹出框是显示空白,请问下这是什么原因

RSA 密钥过长导致error

在使用4096bit的RSA密钥时,无法添加process,会提示X509 error!我看了代码,其中定义的也是BigInteger类型,不知道为什么会出现这种错误?

AES PKCS7加密使用PKCS5的问题

当时我拿到了这段username=admin&password=admin&code=123123&isMandatory%5BisTrusted%5D=true的密文,第一次解密的时候是没有经过这个插件来对以上字符串加密的(密钥和偏移量都给对了),提示not found,然后我使用这个插件对上面这段字符进行加密之后(加密后和原来js加密的一致的),再来对刚才提示not found的那段密文进行解密就能解出来,但是没有加密之前就不能解出来

插件js模块不生成加密后的数据

作者你好,在分析一个网站的时候,在浏览器直接运行js代码,调用加密函数是可以加密的。但是到了插件里面,直接不生成了。排除使用方式错误的可能。

使用报错

使用AES加密后,插件报错,具体如下
java.lang.IllegalStateException: java.security.InvalidAlgorithmParameterException: Wrong IV length: must be 16 bytes long
at burp.aes.AesUtil.fail(AesUtil.java:83)
at burp.aes.AesUtil.doFinal(AesUtil.java:78)
at burp.aes.AesUtil.encrypt(AesUtil.java:51)
at burp.aes.AesIntruderPayloadProcessor.processPayload(AesIntruderPayloadProcessor.java:26)
at burp.utils.BurpCryptoMenuFactory.lambda$createMenuItems$1(BurpCryptoMenuFactory.java:53)
at java.desktop/javax.swing.AbstractButton.fireActionPerformed(AbstractButton.java:1972)
at java.desktop/javax.swing.AbstractButton$Handler.actionPerformed(AbstractButton.java:2313)
at java.desktop/javax.swing.DefaultButtonModel.fireActionPerformed(DefaultButtonModel.java:405)
at java.desktop/javax.swing.DefaultButtonModel.setPressed(DefaultButtonModel.java:262)
at java.desktop/javax.swing.AbstractButton.doClick(AbstractButton.java:374)
at java.desktop/javax.swing.plaf.basic.BasicMenuItemUI.doClick(BasicMenuItemUI.java:1022)
at java.desktop/javax.swing.plaf.basic.BasicMenuItemUI$Handler.mouseReleased(BasicMenuItemUI.java:1066)
at java.desktop/java.awt.Component.processMouseEvent(Component.java:6617)
at java.desktop/javax.swing.JComponent.processMouseEvent(JComponent.java:3342)
at java.desktop/java.awt.Component.processEvent(Component.java:6382)
at java.desktop/java.awt.Container.processEvent(Container.java:2264)
at java.desktop/java.awt.Component.dispatchEventImpl(Component.java:4993)
at java.desktop/java.awt.Container.dispatchEventImpl(Container.java:2322)
at java.desktop/java.awt.Component.dispatchEvent(Component.java:4825)
at java.desktop/java.awt.LightweightDispatcher.retargetMouseEvent(Container.java:4934)
at java.desktop/java.awt.LightweightDispatcher.processMouseEvent(Container.java:4563)
at java.desktop/java.awt.LightweightDispatcher.dispatchEvent(Container.java:4504)
at java.desktop/java.awt.Container.dispatchEventImpl(Container.java:2308)
at java.desktop/java.awt.Window.dispatchEventImpl(Window.java:2773)
at java.desktop/java.awt.Component.dispatchEvent(Component.java:4825)
at java.desktop/java.awt.EventQueue.dispatchEventImpl(EventQueue.java:772)
at java.desktop/java.awt.EventQueue$4.run(EventQueue.java:721)
at java.desktop/java.awt.EventQueue$4.run(EventQueue.java:715)
at java.base/java.security.AccessController.doPrivileged(AccessController.java:391)
at java.base/java.security.ProtectionDomain$JavaSecurityAccessImpl.doIntersectionPrivilege(ProtectionDomain.java:85)
at java.base/java.security.ProtectionDomain$JavaSecurityAccessImpl.doIntersectionPrivilege(ProtectionDomain.java:95)
at java.desktop/java.awt.EventQueue$5.run(EventQueue.java:745)
at java.desktop/java.awt.EventQueue$5.run(EventQueue.java:743)
at java.base/java.security.AccessController.doPrivileged(AccessController.java:391)
at java.base/java.security.ProtectionDomain$JavaSecurityAccessImpl.doIntersectionPrivilege(ProtectionDomain.java:85)
at java.desktop/java.awt.EventQueue.dispatchEvent(EventQueue.java:742)
at java.desktop/java.awt.EventDispatchThread.pumpOneEventForFilters(EventDispatchThread.java:203)
at java.desktop/java.awt.EventDispatchThread.pumpEventsForFilter(EventDispatchThread.java:124)
at java.desktop/java.awt.EventDispatchThread.pumpEventsForHierarchy(EventDispatchThread.java:113)
at java.desktop/java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:109)
at java.desktop/java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:101)
at java.desktop/java.awt.EventDispatchThread.run(EventDispatchThread.java:90)
Caused by: java.security.InvalidAlgorithmParameterException: Wrong IV length: must be 16 bytes long
at java.base/com.sun.crypto.provider.CipherCore.init(CipherCore.java:528)
at java.base/com.sun.crypto.provider.AESCipher.engineInit(AESCipher.java:355)
at java.base/javax.crypto.Cipher.init(Cipher.java:1442)
at java.base/javax.crypto.Cipher.init(Cipher.java:1375)
at burp.aes.AesUtil.doFinal(AesUtil.java:71)
... 40 more

配置如下:
CleanShot 2022-02-28 at 11 30 43@2x

关于执行js代码中时间戳问题

function getData() {
return new Date().getTime();
}
正常执行返回时间戳:1651202830901
但在插件中使用Rhino返回的为:1.651202909136E12这种形式
不知是我使用问题还是啥。

有个算法需要添加

var key = CryptoJS.enc.Utf8.parse('GftZqNEoBVdB2kwT');

    // iv采用的是16位的,同样为了方便转成UTF8
     var iv = CryptoJS.enc.Utf8.parse('3zyJFPEzh5rUeUNh'); 

    // 加密方式使用CBC,padding偏移量设置成Pkcs7,以便和后端对应解密
   let encryptData = CryptoJS.AES.encrypt(password, key, {
                        mode: CryptoJS.mode.CBC,
                        iv: iv,
                        padding: CryptoJS.pad.Pkcs7
                    });

3des加密bug

BurpCrypto v0.1.7: java.lang.IllegalStateException: java.security.InvalidKeyException: No installed provider supports this key: com.sun.crypto.provider.DESKey

添加DESede加密
burp.des.DesUtil

try {
    String algType = algName.split("/")[0];

    KeySpec desKey = null;
    if (algType.equals("DES")) {
        desKey = new DESKeySpec(config.Key);
    }else {
        desKey = new DESedeKeySpec(config.Key);
    }

    SecretKeyFactory keyFactory = SecretKeyFactory.getInstance(algType);
    sKey = keyFactory.generateSecret(desKey);

} catch (Exception ex) {
    throw fail(ex);
}

解密功能优化建议

大佬好,对于解密功能的实现,是不是可以考虑给每个加密算法的实现类(AesUtil)加入一个参数,比如isCache=false,然后根据这个参数来判断是否支持直接解密。

  1. 如果是对称加密算法,则将该参数设为false,解密时使用密钥进行解密
  2. 如果是rsa或者execjs,则根据用户配置来决定该参数是false还是true

比如:
如果用户配置了私钥,那么就将该参数设为false,加密时直接加密返回,不做其他操作,解密时使用私钥进行解密;
如果没有配置私钥,则将该参数设为true,加密时将明文写入数据库,解密时从数据库中提取明文

SM4加密算法报错

BurpSuite:2014.1.1
JDK Ver:17.0.5+9-LTS-191
无法添加SM4算法到processor,log显示
Cannot find any provider supporting SM4/ECB/NoPadding
Log:
cn.hutool.crypto.CryptoException: NoSuchAlgorithmException: Cannot find any provider supporting SM4/ECB/NoPadding
at cn.hutool.crypto.SecureUtil.createCipher(SecureUtil.java:1034)
at cn.hutool.crypto.CipherWrapper.(CipherWrapper.java:39)
at cn.hutool.crypto.symmetric.SymmetricCrypto.init(SymmetricCrypto.java:150)
at cn.hutool.crypto.symmetric.SymmetricCrypto.(SymmetricCrypto.java:127)
at cn.hutool.crypto.symmetric.SM4.(SM4.java:171)
at cn.hutool.crypto.symmetric.SM4.(SM4.java:146)
at cn.hutool.crypto.symmetric.SM4.(SM4.java:78)
at burp.sm4.SM4Util.setConfig(SM4Util.java:22)
at burp.sm4.SM4IntruderPayloadProcessor.(SM4IntruderPayloadProcessor.java:15)
at burp.sm4.SM4UIHandler.lambda$getPanel$1(SM4UIHandler.java:112)
...

RSA加密 处理超长内容报错

当加密长度过长时,需做字符长度判断,进行分组加密

javax.crypto.IllegalBlockSizeException: Data must not be longer than 117 bytes

RSA功能模块失效?

设置了RSA的加密方式,发现无法在爆破模块正常进行爆破,而AES可以。

新功能建议

可以考虑增加一下国密模块吗,现在越来越多的系统开始改用国密算法了。

rsa添加后无任何提示,测试aes正常

java 11
burp v2022.8.2
crypto v0.19.1

image
image
010001
9E10BACC91A43532A9C3124C917DB596BF9F5BEDBB4B8D08E69695FC92188093DD9A3DCC30F88C60CA63673FAFC916F96B4EBC79D1280BDCDFBB236850AF0B2F5A252C42F098EEE3F3A79E37C394B87D47AE2FF55D9F838B6298D09231ECDA9952DBA7F76044F3C19F55F7F748CDE361064FC1E81B44F924B3ADE81638D5E8E9

使用自定义加密方式的无法实现加密效果

在使用自定义加密方式爆破时不生效
image
image
代码报错
java.lang.NullPointerException: Cannot invoke "burp.api.montoya.core.ByteArray.getBytes()" because the return value of "burp.api.montoya.intruder.IntruderInsertionPoint.baseValue()" is null
at burp.Zirr.processPayload(Unknown Source)
at burp.Zucp.Zu(Unknown Source)
at burp.Zqw6.Zu(Unknown Source)
at burp.Zih7.ZE(Unknown Source)
at burp.Zwus.Zw(Unknown Source)
at burp.Zwus.Zx(Unknown Source)
at burp.Zqh1.Zp(Unknown Source)
at burp.Zqhm.Zb(Unknown Source)
at burp.Zy_n.ZJ(Unknown Source)
at burp.Zwmb.Zy(Unknown Source)
at burp.Zwmb.ZM(Unknown Source)
at burp.Ziog.ZI(Unknown Source)
at burp.Ziog.ZR(Unknown Source)
at burp.Zh74.Z_(Unknown Source)
at burp.Zbc.Zy(Unknown Source)
at burp.Zbc.ZL(Unknown Source)
at burp.Zyii.ZR(Unknown Source)
at burp.Zuv.run(Unknown Source)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642)
at java.base/java.lang.Thread.run(Thread.java:1589)

Exec Js 加载js库

我在js中有这样一段:
var CryptoJS = require("crypto-js");
复制到Exec js中会报错:
org.mozilla.javascript.EcmaError: ReferenceError: "require" is not defined. (RhinoEngine#2)

该怎么解决呢?

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.