Capturing Plaintext with Burp Suite Using a Double‑Layer MITM

Problem

The target web application encrypts both request and response payloads with SM2. The public key encrypts data on the client side, while a different private key decrypts data on the server side, making it impossible to obtain plaintext directly.

Principle

Double‑layer MITM intercepts traffic, decrypts it for Burp Suite, then re‑encrypts it before forwarding.

Request: browser → mitmproxy (decrypt) → Burp Suite (plaintext) → mitmproxy (encrypt) → server
Response: server → mitmproxy (decrypt) → Burp Suite (plaintext) → mitmproxy (encrypt) → browser

Analysis of encryption

Use MCP Chrome‑devtools or download the JavaScript files locally so a large language model can analyse the SM2 encryption/decryption logic. Save the captured request/response packets to a markdown file and note the file paths of the public and private keys.

MITM Setup

Install mitmproxy: pip install mitmproxy Run mitmproxy in client mode (upstream proxy points to Burp Suite):

set MITM_MODE=client
mitmdump -s mitmproxy_addon.py --mode upstream:http://127.0.0.1:8080 -p 8888

Configure Burp Suite to use the upstream proxy (port 8888).

Run mitmproxy in server mode to forward traffic back to the browser:

set MITM_MODE=server
mitmdump -s mitmproxy_addon.py -p 8889

Common issues

If the generated Python script does not replace the public/private keys in the JavaScript files, edit the script to perform the substitution.

When execution errors occur, copy the error messages and feed them to an AI model for troubleshooting.

Skill repository

The complete procedure is packaged as a skill in the following GitHub directory:

https://github.com/boqiqibo/Sec-Skills/tree/main/analyze-encrypted-web-traffic