# outlaws-bai/Galaxy

一个想让你测试加密流量像测试明文一样简单高效的 Burp 插件。 A Burp plugin that makes testing encrypted traffic as simple and efficient as testing plaintext.

Repository: https://github.com/outlaws-bai/Galaxy
Canonical: https://ross.abutalabs.com/products/outlaws-bai-galaxy
Language: Java
License: Apache-2.0
License Family: permissive
Topics: burpsuite-extender, encrypted-messages, burp-plugin, burpsuite, pentest
Last push: 2026-08-24T03:48:38+00:00

## Health v2 (maintenance only)
Score: 88/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 99, release rhythm 87, longevity 65
- inputs: {"age_days": 917, "days_push": 9, "days_rel": 9, "gap_med": 33, "n_releases_24m": 14}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1109, forks 72 (observed 2026-08-28T04:03:37.311271+00:00)

## What it is
Galaxy is a Burp Suite extension that automatically decrypts and re-encrypts HTTP traffic whose payloads are encrypted, letting testers work with plaintext in Proxy, Repeater, Intruder, and Scanner. It supports custom hooks for complex encryption logic and integrates with tools like sqlmap and xray for scanning decrypted requests.

## Use cases
- decrypt encrypted HTTP request and response bodies in Burp Suite
- test web APIs that encrypt traffic with custom or combined algorithms
- send decrypted plaintext requests to sqlmap for SQL injection scanning
- forward decrypted requests to xray for automated vulnerability scanning
- hook client-side code to reverse and invoke a site's encryption logic
- fuzz encrypted parameters with Burp Intruder in plaintext

## When to choose
- you are pentesting a site whose HTTP messages are encrypted
- encryption logic is complex, e.g. algorithm combinations, custom ciphers, or dynamic keys
- you want scanners like sqlmap or xray to work against encrypted traffic
- you can reverse the site's crypto logic or hook its client code

## When to avoid
- traffic is plain HTTP/HTTPS without application-layer encryption
- you cannot reverse or hook the site's encryption logic
- you need a standalone proxy outside Burp Suite

## Facets
- artifact type: plugin
- maturity: active
- function: security, penetration-testing, proxy, middleware
- domain: security, penetration-testing, web-development
- platform: jvm
- tags: burpsuite, burp-extension, traffic-decryption, mitm, encrypted-traffic, pentest, sqlmap, xray, desktop

## Member repositories
- outlaws-bai/Galaxy (main) score 88

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:03:37.311271+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T06:43:37.503488+00:00, confidence not recorded.
  - readme: https://github.com/outlaws-bai/Galaxy (fetched 2026-08-28T04:03:37.311271+00:00, sha d45a07cbd80b)
- Data as of 2026-08-30T08:39:29.467469+00:00.