Jaysen13/jaysenwxapkg

What it solves

JaySenWxapkg is a penetration testing tool designed to analyze WeChat mini-programs. It simplifies the process of decrypting and decompiling wxapkg files to uncover hidden API endpoints, sensitive data leaks, and potential vulnerabilities in the mini-program's backend infrastructure.

How it works

The tool operates as a Burp Suite extension that automates several security analysis steps:

1. Decryption and Decompilation: It automatically identifies and decrypts encrypted wxapkg packages using AES-CBC and XOR, then recursively scans and unpacks the main and sub-packages.
2. API Extraction: It uses customizable regular expressions to scan the decompiled source code for API endpoints, filtering out frontend paths and static assets.
3. Sensitive Data Detection: It scans for patterns like phone numbers, ID cards, AppIDs, and secret keys using built-in and custom regex rules.
4. AI-Powered Parameter Inference: It integrates with LLMs (such as DeepSeek, OpenAI, or Tongyi Qianwen) to analyze the decompiled source code context (5 lines before and after the API call) and Burp's request history to predict the required request parameters for the extracted APIs.
5. Request Execution: Once the AI predicts the parameters, the tool can automatically send the constructed HTTP requests directly through Burp Suite for testing.

Who it’s for

Security researchers, penetration testers, and developers who need to analyze the same-origin backend APIs of WeChat mini-programs for security auditing.

Highlights

• Automated Decryption: One-click decryption and unpacking of the latest WeChat mini-program packages.
• AI-Driven Analysis: Uses LLMs to infer API parameters based on actual source code context and naming styles, significantly increasing accuracy over simple path analysis.
• Burp Suite Integration: Seamlessly integrates with Burp Suite's visualization panel and request history for a streamlined workflow.
• Customizable Rules: Flexible configuration for API extraction and sensitive data detection via regular expressions.
• Automatic Prefix Correction: Automatically corrects incomplete API paths caused by baseUrl concatenation in the mini-program code.