JaysenWxapkg is a Burp Suite extension designed to automate the decryption, unpacking, and security analysis of WeChat mini-program packages (wxapkg). It targets security researchers and developers by streamlining the extraction of sensitive information, API endpoints, and inferring API request parameters, thereby accelerating the penetration testing and code review process for WeChat mini-programs.

How It Works

The tool operates within Burp Suite, providing a visual interface for its functionalities. It employs AES-CBC+XOR decryption to handle encrypted wxapkg files, supporting both PC client cache packages and the latest WeChat versions. The extension recursively scans directories for multiple packages, performing multi-threaded unpacking and cleanup. API extraction is facilitated by customizable regular expressions, while sensitive data detection uses built-in rules for phone numbers, IDs, and secrets, extensible with user-defined patterns. A key feature is its AI-powered parameter inference, which leverages source code context (surrounding lines of API paths) and historical Burp traffic to intelligently guess API request parameters, then automatically sends test requests.

Quick Start & Requirements

• Primary install / run command: Install as a Burp Suite extension. Locate WeChat mini-program package paths (e.g., C:\Users\<username>\AppData\Roaming\Tencent\xwechat\radium\packages\) and select files within the plugin.
• Non-default prerequisites and dependencies: Burp Suite. For AI parameter inference, access to LLM APIs (OpenAI, DeepSeek, Tongyi Qianwen compatible) with API keys, model URLs, and potentially custom headers is required.
• Links: Project repository: https://github.com/Jaysen13/jaysenwxapkg

Highlighted Details

• Supports the latest WeChat versions and automates decryption (AES-CBC+XOR) of wxapkg files.
• Features batch unpacking, recursive scanning, and API extraction with custom regex filtering.
• Includes built-in detection for sensitive information like phone numbers, IDs, and secrets.
• AI parameter inference uses source code context and historical requests for accurate parameter prediction and auto-correction of URL prefixes.
• Provides a visualized interface within Burp Suite for clear display of小程序 information, API results, and sensitive data.

Maintenance & Community

The project is maintained by Jaysen13. Community engagement and updates are primarily channeled through the GitHub repository. Contact is available via email (3147330392@qq.com) and a WeChat public account ("凌霜雁安全志") which shares cybersecurity knowledge and tool recommendations.

Licensing & Compatibility

The project is licensed under the MIT License. This permits commercial use and secondary development, provided the original author's copyright notice is retained.

Limitations & Caveats

The README does not explicitly detail known bugs or alpha status. Functionality relies on the correct identification of WeChat package paths, which may change with WeChat client updates. The advanced AI parameter inference feature requires external LLM API access and configuration.