CrypticBurp, Encrypted Traffic Editor

CrypticBurp handles application-layer encryption layered on top of TLS. It intercepts requests and responses, decrypts the ciphertext into a Decrypted tab for editing, and re-encrypts modified content before forwarding it to the server, making tools like Repeater functional against apps that encrypt their API traffic.

Features

• Decrypts and re-encrypts query strings, request bodies, and response bodies, with per-location padding configuration within a single profile
• Supports targeting a specific JSON field or form field containing ciphertext, rather than treating the entire body as raw ciphertext
• Handles prepended per-message IVs by automatically splitting or prepending the IV during decryption and re-encryption (encode(IV ? ciphertext))
• Pretty-prints JSON in the Decrypted tab for readability and minifies it back before re-encryption
• Per-host and per-path scoping ensures the extension only processes matching traffic and does not interfere with unrelated requests
• Configuration can be saved and loaded as JSON profile files, allowing reuse across different targets
• Supports multiple cipher algorithms, key formats, encodings, and padding schemes including PKCS7 and custom byte paddings

Usage

1. Obtain the target applications encryption key and IV through static analysis, dynamic instrumentation, or Frida hooks.
2. Open the CrypticBurp tab.
3. Fill in the target host and path to scope which traffic is processed.
4. Enter the cipher algorithm, key, key format, encoding, and padding for each location (query string, request body, response body) you want to decrypt.
5. Set the IV mode: use a fixed IV, derive it from the key, or select prepended to ciphertext if the app uses a per-message IV.
6. Click Apply Config to activate the profile. Optionally click Save Profile to write the configuration to a JSON file for later reuse.
7. Send or proxy requests matching the configured host and path → inspect and edit plaintext in the Decrypted tab → the extension re-encrypts your edits before the request reaches the server.
8. To load a saved profile, click Load Profile and select the corresponding JSON file, then click Apply Config.