BubblePop - Bubble.io ElasticSearch Decryptor

BubblePop enables security testing of Bubble.io applications by automatically decrypting and re-encrypting their Elasticsearch payload data. Bubble.io applications encrypt their Elasticsearch database queries, preventing direct analysis. This extension removes that barrier, allowing security professionals to inspect and modify database operations during security assessments.

Features

• Automatic detection and decryption of encrypted Elasticsearch payloads using the Bubble application name
• Dedicated message editor tab for real-time payload inspection and modification
• Transparent re-encryption of modified payloads for seamless request manipulation

Usage

1. Navigate to the BubblePop tab in the main interface
2. Enter the target Bubble.io application name in the configuration field and click Save
3. Use Proxy to intercept traffic from the Bubble.io application
4. When encrypted Elasticsearch requests are intercepted, select the BubblePop tab in the message editor to view decrypted database queries and JSON data
5. Modify the decrypted content as needed for security testing
6. Forward or repeat the request → the extension automatically re-encrypts your modifications