AES_Killer_v3.0.java

package burp;

import java.io.PrintWriter;
import java.net.URL;
import java.security.NoSuchAlgorithmException;
import java.util.Arrays;
import java.util.Base64;
import java.util.List;
import java.util.logging.Level;
import java.util.logging.Logger;
import javax.crypto.Cipher;
import javax.crypto.NoSuchPaddingException;
import javax.crypto.SecretKey;
import javax.crypto.spec.IvParameterSpec;
import javax.crypto.spec.SecretKeySpec;

/**
 *
 * @author bugzy
 */
public class BurpExtender implements IBurpExtender, IProxyListener, IHttpListener{

    public String ExtensionName =  "AES_Killer v3.0";
    
    public IBurpExtenderCallbacks callbacks;
    public IExtensionHelpers helpers;
    public PrintWriter stdout;
    public PrintWriter stderr;
    public Boolean isDebug = true;
    
    public Cipher cipher;
    public IvParameterSpec iv_param;
    public SecretKey sec_key;
    
    public String Host_URL = "http://<URL/IP/Host>";
    
    public String[] offusicatedChar = {"+", "/"};
    public String[] replaceWithChar = {"-", "_"};
    
    // Endpoints and their corresponding parameters in order
    public String[] endpoints = {
        "/Login",
        "/api/GetAccountBalance",
        "/api/TarnsferPayment"
    };
    public String[][] parameters = {
        {"username", "password"},
        {"AccNo"},
        {"AccNo", "Amount"}
    };
    
    
    // Endpoint Classification
    public String[] get_ep  = { "/api/GetAccountBalance" };
    public String[] json_ep = { "/api/TarnsferPayment" };
    public String[] form_ep = { "/Login" };
    
    @Override
    public void registerExtenderCallbacks(IBurpExtenderCallbacks callbacks) {
        this.callbacks = callbacks;
        this.helpers = callbacks.getHelpers();
        this.stdout = new PrintWriter(callbacks.getStdout(), true);
        this.stderr = new PrintWriter(callbacks.getStderr(), true);
        this.callbacks.setExtensionName(this.ExtensionName);
                
        try {
            cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
            sec_key = new SecretKeySpec(Base64.getDecoder().decode(" <Base64 encoded SecretKey> "),"AES");
            iv_param = new IvParameterSpec(Base64.getDecoder().decode(" <Base64 encoded IV> "));
        } catch (NoSuchAlgorithmException ex) {
            Logger.getLogger(BurpExtender.class.getName()).log(Level.SEVERE, null, ex);
        } catch (NoSuchPaddingException ex) {
            Logger.getLogger(BurpExtender.class.getName()).log(Level.SEVERE, null, ex);
        }
        
        
        this.callbacks.registerHttpListener(this);
        this.callbacks.registerProxyListener(this);
        this.stdout.println("AES_Killer Installed !!!");
    }

    private void print_output(String _src, String str){
        if(! isDebug){ return; }
        this.stdout.println(_src.toString() + " :: " + str.toString() + "\n");
    }
    
    private void print_error(String _src, String str){
        if(! isDebug){ return; }
        this.stderr.println(_src + " :: " + str);
    }
    
    private String do_Decrypt(String paramString){
        try{
            String temp_params = removeOff(this.helpers.urlDecode(paramString));
            cipher.init(2, sec_key ,iv_param);
            temp_params = new String (cipher.doFinal(this.helpers.base64Decode(temp_params)), "UTF-8");
            return temp_params;
        }catch(Exception ex){
            print_error("do_Decrypt", ex.getMessage());
            return paramString;
        }
    }
        
    private String do_Encrypt(String paramString){
        try{
            String temp_params = paramString;
            cipher.init(1, sec_key ,iv_param);
            temp_params = new String (this.helpers.base64Encode(cipher.doFinal(temp_params.getBytes())));
//            return this.helpers.urlEncode(doOff(temp_params));
            return temp_params;
        }catch(Exception ex){
            print_error("do_Encryp", ex.getMessage());
            return paramString;
        }
    }
    
    public String removeOff(String paramString) {
        if (paramString != null) {
          for(int i =0; i< this.offusicatedChar.length; i++){
              paramString = paramString.replace(this.replaceWithChar[i], this.offusicatedChar[i]);
          }
          return paramString;
        }
        return paramString;
    }
    
    public String doOff(String paramString) {
        if (paramString != null) {
          for(int i =0; i< this.offusicatedChar.length; i++){
              paramString = paramString.replace(this.offusicatedChar[i], this.replaceWithChar[i]);
          }
          return paramString;
        }
        return paramString;
    }
    
    public String get_endpoint(String _url){
        try{
            URL abc = new URL(_url);
            return abc.getPath().toString();
        }catch (Exception ex){
            print_error("get_endpoint", _url);
            return _url;
        }
    }

    public int get_ep_index(String _endpoint){
        return Arrays.asList(this.endpoints).indexOf(_endpoint);
    }
    
    public boolean ep_exists(String _endpoint){
        if (Arrays.asList(this.endpoints).contains(_endpoint)){
            return true;
        }
        return false;
    }
    
    public boolean is_ep_get(String _endpoint){
        if (Arrays.asList(this.get_ep).contains(_endpoint)){
            return true;
        }
        return false;
    }
    
    public boolean is_ep_json(String _endpoint){
        if (Arrays.asList(this.json_ep).contains(_endpoint)){
            return true;
        }
        return false;
    }

    public boolean is_ep_form(String _endpoint){
        if (Arrays.asList(this.form_ep).contains(_endpoint)){
            return true;
        }
        return false;
    }
    
    public String get_param(byte[] _tmp_req, String _req_param){
        IParameter _parameters = this.helpers.getRequestParameter(_tmp_req, _req_param);
        String _param = _parameters.getValue().toString();
        _param = this.helpers.urlDecode(_param);
        return _param;
    } 
    
    // This can vary depending upon application backend
    public String remove_padding(String _pad_param){
        _pad_param = _pad_param.replaceAll("\u0000", "");
        _pad_param = _pad_param.substring(4, _pad_param.length());
        _pad_param = _pad_param.substring(0, _pad_param.length() - 10);
        return _pad_param;
    }
    
    // This can vary depending upon application backend
    public String add_null(String _str){
        StringBuilder _null_str = new StringBuilder();
        for(int i=0; i< _str.length(); i++){
            _null_str.append(String.valueOf("\u0000"));
            _null_str.append(String.valueOf("\u0000"));
            _null_str.append(String.valueOf("\u0000"));
            _null_str.append(_str.toCharArray()[i]);
        }
        return _null_str.toString();
    }
    
    // This can vary depending upon application backend
    public String add_padding(String _nml_param){
        return ("<desire string>" + add_null("<desire string>") + add_null(_nml_param) + add_null("<desire string>") + String.valueOf("\u0000")+ String.valueOf("\u0000")+ String.valueOf("\u0000"));
    }
    
    // This can vary depending upon application backend
    public String return_padding(){
        return ("1" + add_null("<desire string>") + add_null("<desire string>") + String.valueOf("\u0000")+ String.valueOf("\u0000")+ String.valueOf("\u0000"));
    }
    
    public byte[] update_parameter(byte[] _tmp_req, String _parameter, String _new_value){
        byte[] _tmp_new_req;
        
        IParameter old_param = this.helpers.getRequestParameter(_tmp_req, _parameter);        
        IParameter new_param = this.helpers.buildParameter(_parameter, _new_value, old_param.getType());

        _tmp_new_req = this.helpers.removeParameter(_tmp_req, old_param);
        _tmp_new_req = this.helpers.addParameter(_tmp_new_req, new_param);
        
        return _tmp_new_req;
    }
    
    public byte[] update_parameter_json(byte[] _tmp_req, String _parameter, String _new_value){
               
        IRequestInfo reqInfo = helpers.analyzeRequest(_tmp_req);
        String tmpreq = new String(_tmp_req);
        String messageBody = new String(tmpreq.substring(reqInfo.getBodyOffset())).trim();

        int _lst_index = messageBody.indexOf(_parameter) + _parameter.length() + 3;
        String _rst_msg = messageBody.substring(_lst_index, messageBody.length());

        int _qut_index = _rst_msg.indexOf("\"");
        String _new_str = _rst_msg.substring(_qut_index, _rst_msg.length());
        String _final_body = messageBody.substring(0, _lst_index) + _new_value + _new_str;
        
        byte[] _tmp_new_req = this.helpers.buildHttpMessage(reqInfo.getHeaders(), _final_body.getBytes());
        return _tmp_new_req;
    }
    
    public byte[] get_dec_params(byte[] _tmp_req, String _endpoint){
        int _index = get_ep_index(_endpoint);
        String[] _params = this.parameters[_index];
        
        if(is_ep_get(_endpoint) || is_ep_form(_endpoint)){
            for(int i=0; i< _params.length; i++){
                String _param = get_param(_tmp_req, _params[i]);
                _param = this.helpers.urlDecode(_param);
                _param = this.do_Decrypt(_param);
                _param = remove_padding(_param);
                
                _tmp_req = update_parameter(_tmp_req, _params[i], _param);
            }   
        }
        else if (is_ep_json(_endpoint)){
            for(int i=0; i< _params.length; i++){
                String _param = get_param(_tmp_req, _params[i]);
                _param = this.helpers.urlDecode(_param);
                _param = this.do_Decrypt(_param);
                _param = remove_padding(_param);
                                
                _tmp_req = update_parameter_json(_tmp_req, _params[i], _param);
            }
        }
        return _tmp_req;
    }
    
    public byte[] get_enc_params(byte[] _tmp_req, String _endpoint){
        int _index = get_ep_index(_endpoint);
        String[] _params = this.parameters[_index];

         if(is_ep_get(_endpoint) || is_ep_form(_endpoint)){
            for(int i=0; i< _params.length; i++){
                String _param = get_param(_tmp_req, _params[i]);
                _param = add_padding(_param);                
                _param = this.do_Encrypt(_param);
                _param = this.doOff(_param);
//                _param = this.helpers.urlEncode(_param);
                
                _tmp_req = update_parameter(_tmp_req, _params[i], _param);
            }   
        }
        else if (is_ep_json(_endpoint)){
            for(int i=0; i< _params.length; i++){
                String _param = get_param(_tmp_req, _params[i]);
                _param = add_padding(_param);                
                _param = this.do_Encrypt(_param);
                                
                _tmp_req = update_parameter_json(_tmp_req, _params[i], _param);
            }
        }         
        return _tmp_req;
    }
    
    
    @Override
    public void processProxyMessage(boolean messageIsRequest, IInterceptedProxyMessage message) {
        if(messageIsRequest){
            IHttpRequestResponse messageInfo = message.getMessageInfo();
            IRequestInfo reqInfo = helpers.analyzeRequest(messageInfo);
            String URL = new String(reqInfo.getUrl().toString());
            List headers = reqInfo.getHeaders();
            
            if(URL.contains(this.Host_URL)){
                String _endpoint = get_endpoint(URL);
                
                if(!ep_exists(_endpoint)){ return; }
                
                byte[] tmpreq = message.getMessageInfo().getRequest();                
                byte[] _dec_req = get_dec_params(tmpreq, _endpoint);

                this.helpers.analyzeRequest(_dec_req).getHeaders().add("AES-Killer: v3.0");
                messageInfo.setRequest(_dec_req);
                print_output("PPM", "decrypted request :: " + new String(_dec_req));
            }
            
        }else {
                // modify accordingly
        }
    }


    @Override
    public void processHttpMessage(int toolFlag, boolean messageIsRequest, IHttpRequestResponse messageInfo) {
        if(messageIsRequest){
            IRequestInfo reqInfo = helpers.analyzeRequest(messageInfo);
            String URL = new String(reqInfo.getUrl().toString());
            List headers = reqInfo.getHeaders();
         
            if(URL.contains(this.Host_URL)){
                String _endpoint = get_endpoint(URL);

                if(!ep_exists(_endpoint)){ return; }

                byte[] _enc_req = get_enc_params(messageInfo.getRequest(), _endpoint);
                messageInfo.setRequest(_enc_req);
                print_output("PHTM :: Final Request\n ", new String(_enc_req));
            }
            
        }
        else{
             // modify accordingly
        }
    }
    
}