web-crypto-proxy

Bypassing frontend RSA encryption for Burp Suite login brute-forcing requires extracting the public key from JavaScript. This skill automates the JS reverse engineering process and generates a mitmproxy script that transparently encrypts plaintext payloads for seamless Burp Suite integration.

Automated web crypto analysis works by fetching target website JS files to identify encryption algorithms like RSA, AES, and SM2/SM4, then extracting the corresponding keys without manual reverse engineering. It generates a proxy script to automatically handle bidirectional encryption and decryption.

The best way to use plaintext payloads in Burp Suite Intruder against encrypted endpoints is to route traffic through a transparent proxy. This skill generates a mitmproxy script that automatically encrypts outgoing requests and decrypts incoming responses for direct plaintext testing.

Yes, you can use mitmproxy to automatically decrypt SM2 and SM4 response data. This skill analyzes frontend SM2/SM4 encryption logic and produces a ready-to-run mitmproxy script that handles bidirectional transparent decryption for integration with Burp Suite.

Yes, web-crypto-proxy supports authorized penetration testing for privilege escalation on encrypted web applications. It automates encryption logic extraction and creates a transparent proxy to test plaintext payloads for privilege escalation checks against encrypted frontend implementations.

Manual JavaScript reverse engineering often fails to extract AES keys due to obfuscated code and time constraints. This skill eliminates manual key extraction efforts by automatically fetching JS files, identifying AES algorithms, and extracting keys to generate a working proxy script.