Hook_CryptoJS.js — Extract CryptoJS symmetric encryption parameters

Description

Hooks all symmetric encryption, hashing, and HMAC algorithms in CryptoJS, including AES, DES, MD5, SHA, and more.

Supported algorithms

Algorithm type	Algorithms
Symmetric encryption	AES, DES, TripleDES, RC4, Rabbit, and more
Hashing	MD5, SHA-1, SHA-256, SHA-512, and more
HMAC	HmacMD5, HmacSHA1, HmacSHA256, and more

When to use it

If a website's requests or responses contain encrypted parameters, enable this script to help analyze the encryption quickly. Example output:

Frequently asked questions

How do I get the padding and cipher mode?

There are two cases:

1. Unobfuscated code

Click the padding code shown in the output to identify the padding scheme:

The cipher mode:

In both cases, identify the mode from the surrounding code.

2. Obfuscated code

Identifying the mode can be harder when the code is obfuscated. For example, Yuanrenxue challenge 18: https://match.yuanrenxue.cn/match/18

The code is heavily obfuscated, so the cipher mode is difficult to recognize:

In this case, use my script for fuzzing symmetric decryption parameters, Fuzz对称加密算法解密参数: https://github.com/0xsdeo/Fuzz_Crypto_Algorithms

The result:

Successful decryption:

Why can't I encrypt or decrypt?

You may have selected the wrong input type for the key or IV. By default, the script prints both in hexadecimal:

Make sure to account for this when using the values.

Why is there no console output after enabling the script?

1. console.log may have been disabled

Try enabling hook log to prevent JavaScript from overwriting the logging method.

2. The website does not use CryptoJS for encryption

This script only logs cryptographic operations performed by CryptoJS. If the website uses another library for encryption or decryption, it will produce no output. If you have confirmed that the website uses CryptoJS but still see no output, contact me (WeChat: I-0xsdeo).

How it works

See:

JavaScript Reverse Engineering — Hooking All CryptoJS Symmetric Encryption Algorithms

JavaScript Reverse Engineering — Hooking All CryptoJS Symmetric Encryption Algorithms, Part 2