Android使用Frida

时间：2017-10-12 14:09:40

标签： android httpsurlconnection frida

我试图学习Frida以吸引各种应用。特别是我试图加入Android应用程序，我使用的是Appmon project。该项目有一个HTTPS.js脚本，它挂接到HttpUrlConnection类的getInputStream和getOutputStream。 HTTPS.js脚本成功挂钩了这些方法，但是当发送HTTPS流量时，我看到的数据是加密的。

根据HTTPUrlConnection上的Android文档，如果URL.openconnection（）方法收到HTTPS网址，则会返回HTTPSUrlConnection对象。

HttpsURLConnection的Android文档声明它是一个扩展HttpURLConnection的抽象类。

  

公共抽象类HttpsURLConnection扩展了HttpURLConnection

我搜索了android源代码，发现HttpsURLConnection是抽象的，并通过DelegatingHttpsURLConnection进行扩展，这也是抽象的。 DelegatingHttpsURLConnection由HttpsURLConnectionImpl

扩展

我已经迷上了

  

com.android.okhttp.internal.huc.HttpsURLConnectionImpl

哪个成功但数据仍然是加密的。这是代码

var HttpsURLConnection = Java.use("com.android.okhttp.internal.huc.HttpsURLConnectionImpl");

HttpsURLConnection.getInputStream.overloads[0].implementation = function() {
try {
  methodURL = "";
responseHeaders = "";
responseBody = "";
var Connection = this;
var stream = stream = this.getInputStream.overloads[0].apply(this, arguments);

var requestURL = Connection.getURL().toString();
var requestMethod = Connection.getRequestMethod();
var requestProperties
methodURL = requestMethod + " " + requestURL;
if (Connection.getHeaderFields) {
  var Keys = Connection.getHeaderFields().keySet().toArray();
  var Values = Connection.getHeaderFields().values().toArray();
  responseHeaders = "";
  for (var key in Keys) {
    if (Keys[key] && Keys[key] !== null && Values[key]) {
      responseHeaders += Keys[key] + ": " + Values[key].toString().replace(/\[/gi, "").replace(/\]/gi, "") + "\n";
    } else if (Values[key]) {
      responseHeaders += Values[key].toString().replace(/\[/gi, "").replace(/\]/gi, "") + "\n";
    }
  }
}
var retval;
if (stream) {
  var baos = ByteArrayOutputStream.$new();
  var buffer = -1;

  var BufferedReaderStream = BufferedReader.$new(InputStreamReader.$new(stream));
  while ((buffer =stream.read()) != -1){
      baos.write(buffer);
      responseBody += String.fromCharCode(buffer);
   }
BufferedReaderStream.close();
baos.flush();
retval = ByteArrayInputStream.$new(baos.toByteArray());

}
/*   --- Payload Header --- */


var send_data = {};
send_data.time = new Date();
send_data.txnType = 'HTTPS';
send_data.lib = 'com.android.okhttp.internal.huc.HttpsURLConnectionImpl';
send_data.method = 'getInputStream';
send_data.artifact = [];
/*   --- Payload Body --- */
var data = {};
data.name = "Request/Response";
data.value = methodURL + "\n" + requestHeaders + "\n" + requestBody + "\n\n" + responseHeaders + "\n" + responseBody;
data.argSeq = 0;
send_data.artifact.push(data);
send(JSON.stringify(send_data));

if(retval)
    return retval;
return stream;
} catch (e) {
  this.getInputStream.overloads[0].apply(this, arguments);
}
}

BTW我计划在我开始工作后提交拉取请求。

Android文档有关于如何创建HTTP请求的example：

URL url = new URL("https://wikipedia.org");
URLConnection urlConnection = url.openConnection();
InputStream in = urlConnection.getInputStream();
copyInputStreamToOutputStream(in, System.out);

读这个告诉我，只是调用getInputStream（）方法应该返回明文流，但它似乎没有这样做。

问题：如何从HTTPS流量中获取明文数据？我可以看到标题，而不是实际的数据

更新10/13

我想知道我看到的数据是否加密，只是编码。这是我收到的数据的剪切：

\\u001f\x8b\\b\\u0000\\u0000\\u0000\\u0000\\u0000\\u0004\\u0000\xed\xbd\\u0007`\\u001cI\x96%&/m\xca{\x7fJ\xf5J\xd7\xe0t\xa1\\b\x80`\\u0013$\xd8\x90@\\u0010\xec\xc1\x88\xcd\xe6\x92\xec\\u001diG#)\xab*\x81\xcaeVe]f\\u0016@\xcc\xed\x9d\xbc\xf7\xde{\xef\xbd\xf7\xde{\xef\xbd\xf7\xba;\x9dN\'\xf7\xdf\xff?\\\\fd\\u0001l\xf6\xceJ\xda\xc9\x9e!\x80\xaa\xc8\\u001f?~|\\u001f?\\"\\u001e\xff\\u001e\xef\\u0016ez\x99\xd7MQ-?\xfbhw\xbc\xf3Q\x9a/\xa7\xd5\xacX^

响应头指示其gzip编码

Content-Encoding: gzip
Content-Length: 438
Content-Type: text/xml; charset=utf-8

我想知道它是否与这个stackoverflow答案有关，尽管传出请求确实有＆＃34; Accept-Encoding：gzip＆＃34;头。我尝试添加对GZIPInputStream的调用，但应用程序不喜欢响应

更新2 所以我能够捕获数据，这是gzip的一个问题。我现在遇到的问题是Android设备上的应用程序会发出GZIPed输入流。要在Frida中显示数据，我必须通过GZIPInputStream运行它，不知道如何再次压缩它以发送到应用程序。我用GZIPOutputStream尝试过，但是没有用。这是我更新的代码。

 HttpURLConnection.getInputStream.overloads[0].implementation = function() {    
try {
  methodURL = "";
responseHeaders = "";
responseBody = "";
var Connection = this;
if("gzip" == Connection.getContentEncoding())
{
    var stream = InputStreamReader.$new(GZIPInputStream.$new(this.getInputStream.apply(this, arguments)));
}   
else
{
    var stream = InputStreamReader.$new(this.getInputStream.apply(this, arguments));
}
}

var requestURL = Connection.getURL().toString();
var requestMethod = Connection.getRequestMethod();
var requestProperties
methodURL = requestMethod + " " + requestURL;
if (Connection.getHeaderFields) {
  var Keys = Connection.getHeaderFields().keySet().toArray();
  var Values = Connection.getHeaderFields().values().toArray();
  responseHeaders = "";
  for (var key in Keys) {
    if (Keys[key] && Keys[key] !== null && Values[key]) {
      responseHeaders += Keys[key] + ": " + Values[key].toString().replace(/\[/gi, "").replace(/\]/gi, "") + "\n";
    } else if (Values[key]) {
      responseHeaders += Values[key].toString().replace(/\[/gi, "").replace(/\]/gi, "") + "\n";
    }
  }
}
var retval;
if (stream) {
  var baos = ByteArrayOutputStream.$new();
  var buffer = -1;

  var BufferedReaderStream = BufferedReader.$new(stream);
  while ((buffer =stream.read()) != -1){
      baos.write(buffer);
      responseBody += String.fromCharCode(buffer);
   }
BufferedReaderStream.close();
baos.flush();
if("gzip" == Connection.getContentEncoding())
{
    retval = GZIPOutputStream.$new(ByteArrayInputStream.$new(baos.toByteArray()));
}
else
{
    retval = ByteArrayInputStream.$new(baos.toByteArray());
}


}
/*   --- Payload Header --- */


var send_data = {};
send_data.time = new Date();
send_data.txnType = 'HTTP';
send_data.lib = 'com.android.okhttp.internal.http.HttpURLConnectionImpl';
send_data.method = 'getInputStream';
send_data.artifact = [];
/*   --- Payload Body --- */
var data = {};
data.name = "Request/Response";
data.value = methodURL + "\n" + requestHeaders + "\n" + requestBody + "\n\n" + responseHeaders + "\n" + responseBody;
data.argSeq = 0;
send_data.artifact.push(data);
send(JSON.stringify(send_data));

if(retval)
    return retval;
return stream;
} catch (e) {
  this.getInputStream.overloads[0].apply(this, arguments);
}
}

0 个答案:

没有答案
相关问题
最新问题