移动安全入门之常见抓包问题二

<network-security-config>   <domain-config>     <domain includeSubdomains="true">example.com</domain>      <trust-anchors>       <certificates src="@raw/my_ca"/>     </trust-anchors>   </domain-config> </network-security-config>

<network-security-config>   <domain-config>     <domain includeSubdomains="true">example.com</domain>      <pin-set expiration="2099-01-01">       <pin digest="SHA-256">fwza0LRMXouZHRC8Ei+4PyuldPDcf3UKgO/04cDM1oE=</pin>     </pin-set>   </domain-config></network-security-config> (向右滑动，查看更多)

// 获取证书输入流InputStream openRawResource = getApplicationContext().getResources().openRawResource(R.raw.bing); Certificate ca = CertificateFactory.getInstance("X.509").generateCertificate(openRawResource);// 创建 Keystore 包含我们的证书KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());keyStore.load(null, null);keyStore.setCertificateEntry("ca", ca);// 创建一个 TrustManager 仅把 Keystore 中的证书 作为信任的锚点TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm()); // 建议不要使用自己实现的X509TrustManager，而是使用默认的X509TrustManagertrustManagerFactory.init(keyStore);// 用 TrustManager 初始化一个 SSLContextsslContext = SSLContext.getInstance("TLS");  //定义：public static SSLContext sslContext = null;sslContext.init(null, trustManagerFactory.getTrustManagers(), new SecureRandom());
OkHttpClient pClient2 = client.newBuilder().sslSocketFactory(sslContext.getSocketFactory(), (X509TrustManager) trustManagerFactory.getTrustManagers()[0]).build();Request request2 = new Request.Builder()    .url("https://www.bing.com/?q=SSLPinningCAfile")    .build();try (Response response2 = pClient2.newCall(request2).execute()) {    message.obj += "\nhttps SSL_PINNING_with_CA_file access bing.com success";    Log.d(TAG, "https SSL_PINNING_with_CA_file access bing.com success return code:"+response2.code());} catch (IOException e) {    message.obj += "\nhttps SSL_PINNING_with_CA_file access bing.com failed";    Log.d(TAG, "https SSL_PINNING_with_CA_file access bing.com failed");    e.printStackTrace();    }(向右滑动，查看更多)

client = OkHttpClient.Builder()    .certificatePinner(new CertificatePinner.Builder()      .add("xxxxxx.com", "sha256/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=")      .build())    .build();(向右滑动，查看更多)

// 该方法检查客户端的证书，若不信任该证书则抛出异常@Overridepublic void checkClientTrusted(X509Certificate[] chain, String authType)throws CertificateException {    ... ...}
// 该方法检查服务器的证书，若不信任该证书同样抛出异常@Overridepublic void checkServerTrusted(X509Certificate[] chain, String authType)throws CertificateException {    ... ...}
// 返回受信任的X509证书数组@Overridepublic X509Certificate[] getAcceptedIssuers() {    return new X509Certificate[0];}

Java.perform(function(){    let SecureX509TrustManager = Java.use("com.xxx.xxxx.xxxx.common.ssl.SecureX509TrustManager");    SecureX509TrustManager["checkServerTrusted"].implementation = function (x509CertificateArr, str) {        console.log('checkServerTrusted is called' + ', ' + 'x509CertificateArr: ' + x509CertificateArr + ', ' + 'str: ' + str);        return;

objection -g com.xxxx.xxxx explore -s "android sslpinning disable"(向右滑动，查看更多)

var TrustManagerImpl = Java.use('com.android.org.conscrypt.TrustManagerImpl');    TrustManagerImpl.verifyChain.implementation = function(untrustedChain, trustAnchorChain, host, clientAuth, ocspData, tlsSctData) {      console.log("[+] bypass success！");      return untrustedChain;};

frida -U -f com.xxxx.xxx -l anti-ssl.js --no-pause

public class SSLHelper {
  /** * 存储客户端自己的密钥 */ private final static String CLIENT_PRI_KEY = "client.bks";  /** * 存储服务器的公钥 */ private final static String TRUSTSTORE_PUB_KEY = "publickey.bks";  /** * 读取密码 */ private final static String CLIENT_BKS_PASSWORD = "123321";  /** * 读取密码 */ private final static String PUCBLICKEY_BKS_PASSWORD = "123321";  private final static String KEYSTORE_TYPE = "BKS";  private final static String PROTOCOL_TYPE = "TLS";  private final static String CERTIFICATE_STANDARD = "X509";  public static SSLSocketFactory getSSLCertifcation(Context context) {      SSLSocketFactory sslSocketFactory = null;      try {          // 服务器端需要验证的客户端证书，其实就是客户端的keystore          KeyStore keyStore = KeyStore.getInstance(KEYSTORE_TYPE);          // 客户端信任的服务器端证书          KeyStore trustStore = KeyStore.getInstance(KEYSTORE_TYPE);          //读取证书          InputStream ksIn = context.getAssets().open(CLIENT_PRI_KEY);          InputStream tsIn = context.getAssets().open(TRUSTSTORE_PUB_KEY);          //加载证书          keyStore.load(ksIn, CLIENT_BKS_PASSWORD.toCharArray());          trustStore.load(tsIn, PUCBLICKEY_BKS_PASSWORD.toCharArray());          //关闭流          ksIn.close();          tsIn.close();
          //初始化SSLContext          SSLContext sslContext = SSLContext.getInstance(PROTOCOL_TYPE);          TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(CERTIFICATE_STANDARD);          KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(CERTIFICATE_STANDARD);
          trustManagerFactory.init(trustStore);          keyManagerFactory.init(keyStore, CLIENT_BKS_PASSWORD.toCharArray());
          sslContext.init(keyManagerFactory.getKeyManagers(), trustManagerFactory.getTrustManagers(), null);          sslSocketFactory = sslContext.getSocketFactory();      } catch (KeyStoreException e) {          e.printStackTrace();      } catch (IOException e) {          e.printStackTrace();      } catch (CertificateException e) {          e.printStackTrace();      } catch (NoSuchAlgorithmException e) {          e.printStackTrace();      } catch (UnrecoverableKeyException e) {          e.printStackTrace();      } catch (KeyManagementException e) {          e.printStackTrace();      }      return sslSocketFactory;  }
}

.p12.bks.pfx

objection -g cn.soulapp.android explore --startup-command "android hooking watch class_method java.io.File.$init  --dump-args(向右滑动，查看更多)

.p12"getAssets().open

Java.perform(function () {    console.log("start..... ");        var hook = Java.use('com.xxx.xxx.xxx');    console.log(hook);    hook.getValue.implementation=function(a){      console.log(a);      console.log(this.getValue(a));      return this.getValue(a);    }});

logcat |grep flutter

static bool ssl_crypto_x509_session_verify_cert_chain(SSL_SESSION *session,                                                      SSL_HANDSHAKE *hs,                                                      uint8_t *out_alert) {  *out_alert = SSL_AD_INTERNAL_ERROR;  STACK_OF(X509) *const cert_chain = session->x509_chain;  if (cert_chain == nullptr || sk_X509_num(cert_chain) == 0) {    return false;  }
  SSL *const ssl = hs->ssl;  SSL_CTX *ssl_ctx = ssl->ctx.get();  X509_STORE *verify_store = ssl_ctx->cert_store;  if (hs->config->cert->verify_store != nullptr) {    verify_store = hs->config->cert->verify_store;  }
  X509 *leaf = sk_X509_value(cert_chain, 0);  const char *name;  size_t name_len;  SSL_get0_ech_name_override(ssl, &name, &name_len);  UniquePtr<X509_STORE_CTX> ctx(X509_STORE_CTX_new());  if (!ctx ||      !X509_STORE_CTX_init(ctx.get(), verify_store, leaf, cert_chain) ||      !X509_STORE_CTX_set_ex_data(ctx.get(),                                  SSL_get_ex_data_X509_STORE_CTX_idx(), ssl) ||      // We need to inherit the verify parameters. These can be determined by      // the context: if its a server it will verify SSL client certificates or      // vice versa.      !X509_STORE_CTX_set_default(ctx.get(),                                  ssl->server ? "ssl_client" : "ssl_server") ||      // Anything non-default in "param" should overwrite anything in the ctx.      !X509_VERIFY_PARAM_set1(X509_STORE_CTX_get0_param(ctx.get()),                              hs->config->param) ||      // ClientHelloOuter connections use a different name.      (name_len != 0 &&       !X509_VERIFY_PARAM_set1_host(X509_STORE_CTX_get0_param(ctx.get()), name,                                    name_len))) {    OPENSSL_PUT_ERROR(SSL, ERR_R_X509_LIB);    return false;  } if (hs->config->verify_callback) {    X509_STORE_CTX_set_verify_cb(ctx.get(), hs->config->verify_callback);  }
  int verify_ret;  if (ssl_ctx->app_verify_callback != nullptr) {    verify_ret =        ssl_ctx->app_verify_callback(ctx.get(), ssl_ctx->app_verify_arg);  } else {    verify_ret = X509_verify_cert(ctx.get());  }
  session->verify_result = X509_STORE_CTX_get_error(ctx.get());
  // If |SSL_VERIFY_NONE|, the error is non-fatal, but we keep the result.  if (verify_ret <= 0 && hs->config->verify_mode != SSL_VERIFY_NONE) {    *out_alert = SSL_alert_from_verify_result(session->verify_result);    return false;  }
  ERR_clear_error();  return true;}

function hook_ssl() {    var base = Module.findBaseAddress("libflutter.so");    console.log("base: " + base);    var ssl_crypto_x509_session_verify_cert_chain = base.add(0x5c6b7c);    Interceptor.attach(ssl_crypto_x509_session_verify_cert_chain, {        onEnter: function(args) {         },        onLeave: function(retval) {            console.log("校验函数返回值: " + retval);            retval.replace(0x1);　　    }　　});}

frida -U xxxxx -l hook.js