AES Killer, decrypt AES traffic on the fly
Summary: A third-party Burp Suite extension called AES Killer, authored by Abdul Wahab and listed at version 4.0 with a last update of 13 May 2021, decrypts and encrypts AES traffic on the fly within Burp. The BApp Store listing states it currently supports only AES/CBC/PKCS5Padding and AES/ECB/PKCS5Padding, and PortSwigger notes that extensions are written by third-party users and come with no warranty of quality or usefulness.
What's compelling: An extension that decrypts AES traffic in transit gives whoever runs it a working view of encrypted application data, and this one has sat unupdated since May 2021 while covering just two cipher and padding combinations - so any team relying on it should know exactly which traffic it can and cannot see.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026