f0ng/autoDecoder

Health v2 · maintenance only

Flags: no_license

Adoption not part of the score

1424 stars · 100 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A Burp Suite extension (written in Java) that lets users plug in custom encryption/decryption logic so intercepted HTTP traffic can be viewed and modified in plaintext while the app's normal encrypted protocol is preserved. It supports brute-forcing encrypted parameters and includes built-in crypto recipes similar to CyberChef.

Use cases

• decrypt encrypted request bodies in burp suite for testing
• automatically encrypt modified requests before they reach the server
• brute force parameters that are encrypted in transit
• test apps that use custom request/response encryption
• view ciphertext traffic in plaintext inside burp
• handle sm2/sm4 encrypted traffic during pentests

When to choose

• you are pentesting a web app or API whose traffic is encrypted with custom logic
• you need to fuzz or brute-force encrypted parameters through burp
• you want mitmproxy-style transformation but inside Burp Suite

When to avoid

• you need a general-purpose HTTP proxy outside of Burp Suite
• your target uses only standard TLS with no application-layer encryption
• you cannot write or adapt a small decryption interface/service

Facets

plugin · maturity active

security cryptography middleware developer-tools security penetration-testing web-development developer-tools jvm cross-platform burp-suite burp-extension encryption-decryption fuzzing brute-force penetration-testing traffic-interception

Member repositories

For agents

markdown · JSON · MCP: product_card(name="f0ng/autoDecoder")