对某金融App的加解密hook+rpc+绕过SSLPinning抓包

android hooking watch class_methon [方法的完整路径] --dump-args --dump-backtrace --dump-return

function main() {  Java.perform(function() {    console.log("正在注入") var data = Java.use('com.xxxx.http.HttpEncrypt');    data.encryptParams.implementation = function(json, signdata) {      console.log("===========================加密算法==========================");      send(json.toString()); //因为是json类型数据，所以需要转换为string类型，否则转发不到burp      var tmp;      var op = recv('send',      function(value) {        tmp = value.payload;        console.log("请求篡改后----->: ", tmp);        return tmp;      });      op.wait();      return this.encryptParams(tmp, signdata);    }    var shuju = Java.use('com.xxxx.http.HttpEncrypt');    data.decryptReponse.implementation = function(content, i) {      console.log("==========================解密算法==============================");      var ret = this.decryptReponse(content, i);      send(ret);      var tmp;      var op = recv('send',      function(value) {        tmp = value.payload;        console.log("请求篡改后----->: ", tmp);        return tmp;
      });      op.wait();      return tmp;    }  });}setTimeout(main, 5000);

from http.server import HTTPServer, BaseHTTPRequestHandler
class RequestHandler(BaseHTTPRequestHandler):    def do_GET(self):        print('Recving request connction...')        request_headers = self.headers        content_length = request_headers.get('content-length')        length = int(content_length[0]) if content_length else 0        print(self.headers)        self.send_response(200)        self.end_headers()        self._send_cors_headers()        self.wfile.write(self.rfile.read(length))    def do_POST(self):        print('Recving request connction...')        req_datas = self.rfile.read(int(self.headers['content-length']))        # print(self.headers)        # print(req_datas)        self.send_response(200)        self._send_cors_headers()        self.end_headers()        self.wfile.write(req_datas)    def _send_cors_headers(self):        self.send_header('Content-type', 'application/json')        self.send_header("Access-Control-Allow-Origin", "*")        self.send_header("Access-Control-Allow-Methods", "*")        self.send_header("Access-Control-Allow-Headers", "Authorization, Content-Type")    def do_OPTIONS(self):        self.send_response(200)        self._send_cors_headers()        self.end_headers()def main(ECHO_PORT):    print('Listening on localhost: %d' % ECHO_PORT)    server = HTTPServer(('127.0.0.1', ECHO_PORT), RequestHandler)    server.serve_forever()if __name__ == '__main__':    main(8889)

adb forward tcp:27042 tcp:27042

'''python toBurp.py中转至burp，动态修改请求'''import osimport timeimport sysimport fridaimport requestsimport json
def on_message(message, data):    if isinstance(message, dict):         if message['type'] == 'send':            payload = message['payload']            if '{' in payload:                data = toburp(message["payload"].encode('utf-8'))                data = {'type': 'send', 'payload': data}                script.post(data)                #script.post({'type': 'send', 'payload': json.loads(data)})                       elif message['type'] == 'error':            print(message['stack'])    else:        if message.has_key("payload"):            print(message["payload"])

#获取设备应用名def get_application_name(device, identifier):    for p in device.enumerate_applications():        if p.identifier == identifier:            return p.name
# 中转到burpdef toburp(data):    proxies = {'http':'http://127.0.0.1:8888'}    url = 'http://127.0.0.1:8889/Hook'    response=requests.post(url,data=data,proxies=proxies)    return(response.text)def main():    #连接设备    device = frida.get_remote_device()    #需要attach的apk包名    pid = device.spawn('com.xxxx.xxxx') #修改为包名    try:        #attach目标进程        session = device.attach(pid)        device.resume(pid)        #加载javaScript脚本        # 修改此处：aaa.js为hook脚本        script_content = open("aaa.js",encoding='utf-8').read()        global script        script = session.create_script(script_content)        script.on("message", on_message)        script.load()        sys.stdin.read()    except KeyboardInterrupt as e:        if session is not None:            session.detach()            device.kill(pid)        sys.exit(0)        if __name__ == "__main__":    main()

public final String encryptParams(JSONObject json, String signData)

var ret = JSON.stringify(tmp);

function strToJson(str){  var json = eval('(' + str + ')');  return json;}

function main(){    Java.perform(function(){        console.log("正在注入")        var data = Java.use('com.xxxx.http.HttpEncrypt');        data.encryptParams.implementation = function(json,signdata){            console.log("===========================加密算法==========================");            send(json.toString());//因为是json类型数据，所以需要转换为string类型，否则转发不到burp            var tmp;            var op = recv('send',function (value) {                tmp = value.payload;                console.log("请求篡改后----->: ", tmp);                return tmp;                           });            op.wait();            return this.encryptParams(tmp,signdata);        }
        var shuju = Java.use('com.xxxx.HttpEncrypt');        data.decryptReponse.implementation = function(content,i){            console.log("==========================解密算法==============================");            var ret = this.decryptReponse(content,i);            send(ret);            var tmp;            var op = recv('send',function (value) {                tmp = value.payload;                console.log("请求篡改后----->: ", tmp);                return tmp;                            });            op.wait();            return tmp;        }    });}setTimeout(main,5000);

android sslpinning disabl

转载至Adminxe博客：https://www.adminxe.com/4302.html