2024-09-22发表2024-09-22更新tool7 分钟读完 (大约1077个字)

20240922-mitmproxy-burpsuite-aes-encrypt-decrypt

mitmproxy-burp-mitmproxy-client encrypt/decrypt

使用mitmproxy对加密流量进行解密/加密，使得burp中可见流量为明文，可重放、爆破.
mitmproxy与burpsuite联动做流量解密。

解密/加密流程图

起两个mitmproxy 服务分别对进入/离开burp的流量的req/res做修改（加/解密）;
mitmproxy 使用

mitmproxy 下载地址;
mitmproxy安装/证书安装

设置mitmproxy 监听，并且设置浏览器连接mitmproxy代理，访问http://mitm.it/，下载对应版本证书，安装为系统根证书。
1
2
# 监听8999端口
mitmproxy -p 8999
启动burpsuite

启动burpsuite，监听9001端口，并设置upstream proxy rule:针对目标host192.168.22.5,使用上游代理点127.0.0.1:8888.

设置近client侧mitmproxy监听服务

# 监听端口:9999
# 上游代理(burp): 127.0.0.1:9001
# 启动脚本 001-encrypt.py
mitmproxy -p 9999 --mode upstream:http://127.0.0.1:9001 -s ./001-client-side.py

设置近server侧mitmproxy监听服务

1
2
3

# 监听端口:8888
# 启动脚本 002-decrypt
mitmproxy -p 8888 -s ./002-server-side.py

mitmproxy 脚本

其中 001-client-side.py 与 002-server-side.py脚本中放置对近client侧，近server侧req/res修改的操作。 AES-256/CBC/Pkcs7Padding 的001-client-side.py 代码模板和002-server-side.py 代码模板

001-client-side代码样例如下:

001-client-side.py

#start
from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives import padding
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
from mitmproxy import http
import base64

#
# AES/256/CBC/Pkcs7Padding
#
# template
#

# Base64 解码密钥和 IV
secret_key_base64 = "dGVzdF9zZWNyZXRfa2V5"
# iv 长度是16位，多余的会被舍弃
iv_base64 = "dGVzdF9pdg=="

secret_key = base64.b64decode(secret_key_base64)
# iv 长度是16位，多余的会被舍弃
iv = base64.b64decode(iv_base64)[:16]

# AES加解密函数
def encrypt_aes(data, key, iv):
    # Pkcs7 padding
    padder = padding.PKCS7(algorithms.AES.block_size).padder()
    padded_data = padder.update(data) + padder.finalize()

    # AES-CBC 加密
    cipher = Cipher(algorithms.AES(key), modes.CBC(iv), backend=default_backend())
    encryptor = cipher.encryptor()
    encrypted_data = encryptor.update(padded_data) + encryptor.finalize()
    return encrypted_data

def decrypt_aes(data, key, iv):
    # AES-CBC 解密
    cipher = Cipher(algorithms.AES(key), modes.CBC(iv), backend=default_backend())
    decryptor = cipher.decryptor()
    decrypted_data = decryptor.update(data) + decryptor.finalize()

    # 去除 Pkcs7 padding
    unpadder = padding.PKCS7(algorithms.AES.block_size).unpadder()
    unpadded_data = unpadder.update(decrypted_data) + unpadder.finalize()
    return unpadded_data

# 处理 response 流量
def response(flow: http.HTTPFlow):
    # 获取 Content-Type
    content_type = flow.response.headers.get("Content-Type", "")

    # 只处理 JSON 响应体，检查 Content-Type 是否为 application/json
    if "application/json" in content_type:

        # 进行加密
        try:
            # 解码 JSON 响应体
            original_body = flow.response.content

            # 加密响应体
            new_encrypted_body = encrypt_aes(original_body, secret_key, iv)

            # Base64 编码加密后的数据
            flow.response.content = base64.b64encode(new_encrypted_body)

            # 如果需要修改 Content-Type，可以设置合适的加密格式标识
            # flow.response.headers["Content-Type"] = "application/octet-stream"
        except Exception as e:
            print(f"Error during encryption: {e}")
    else:
        # 静态资源如JS、PNG等，跳过加密
        print(f"Skipping encryption for Content-Type: {content_type}")
#end

002-server-side代码样例如下:

002-server-side.py

#start
from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives import padding
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
from mitmproxy import http
import base64

#
# AES/256/CBC/Pkcs7Padding
#
# template
#

# Base64 解码密钥和 IV
secret_key_base64 = "dGVzdF9zZWNyZXRfa2V5"
# iv 长度是16位，多余的会被舍弃
iv_base64 = "dGVzdF9pdg=="

secret_key = base64.b64decode(secret_key_base64)
# iv 长度是16位，多余的会被舍弃
iv = base64.b64decode(iv_base64)[:16]

# 流式 AES 加密
def encrypt_aes_stream(data, key, iv):
    cipher = Cipher(algorithms.AES(key), modes.CBC(iv), backend=default_backend())
    encryptor = cipher.encryptor()

    # Pkcs7 padding
    padder = padding.PKCS7(algorithms.AES.block_size).padder()
    padded_data = padder.update(data) + padder.finalize()

    # 分块加密
    encrypted_data = encryptor.update(padded_data) + encryptor.finalize()
    return encrypted_data

# 流式 AES 解密
def decrypt_aes_stream(data, key, iv):
    cipher = Cipher(algorithms.AES(key), modes.CBC(iv), backend=default_backend())
    decryptor = cipher.decryptor()

    # 分块解密
    decrypted_data = decryptor.update(data) + decryptor.finalize()

    # 去除 Pkcs7 padding
    unpadder = padding.PKCS7(algorithms.AES.block_size).unpadder()
    unpadded_data = unpadder.update(decrypted_data) + unpadder.finalize()
    return unpadded_data

# 处理 response 流量
def response(flow: http.HTTPFlow):
    # 只处理有 body 的 response
    if flow.response.content:
        content_type = flow.response.headers.get("Content-Type", "")

        # 只对 JSON 响应体进行解密处理
        if "application/json" in content_type:
            try:
                # 解密响应体
                encrypted_body = flow.response.content
                decoded_encrypted_body = base64.b64decode(encrypted_body)

                # 流式解密
                decrypted_body = decrypt_aes_stream(decoded_encrypted_body, secret_key, iv)

                flow.response.content = decrypted_body

                # 更新 Content-Type
                # flow.response.headers["Content-Type"] = "application/json"
            except Exception as e:
                print(f"Error during decryption: {e}")
#end

20240922-mitmproxy-burpsuite-aes-encrypt-decrypt

mitmproxy-burp-mitmproxy-client encrypt/decrypt

归档