When I conduct a mobile pentest, I have run into payload encryption in HTTP traffic. In general, the AES key and IV ( initialization vector) are located in APK, and can be used to encrypt the payload using Burp suite extensions such as AES killer.

However, it is known that the AES key and IV can also be stored in a secured server instead of local in APK. So, my question is that how can I bypass the payload encryption in HTTP traffic to continue my pentest if there is not any AES key and IV value in local files in the APK. Do you know any method or is the pentest done before it starts ?

  • How is the connection to the "secured server" secured? Why can't you intercept this traffic and obtain the key?
    – Sjoerd
    Commented Sep 22, 2023 at 12:06
  • @Sjoerd it is just a normal server which cannot be leaked any sensitive information. By the way, I could not undestand what you meant by saying "intercept this traffic and obtain the key", when i intercept it with Burp suite, there is encrypted payload, not any aes key. Can you please elaborate your words ? Commented Sep 22, 2023 at 12:35
  • @Sjoerd If you know any other method to decrypt the payload in Burpsuite when you dont know aes key and IV ,can you please share with me ? Commented Sep 22, 2023 at 12:56


You must log in to answer this question.

Browse other questions tagged .