3

我正在尝试学习 Frida 以连接到各种应用程序。具体来说，我正在尝试连接到 Android 应用程序，我正在使用Appmon 项目。该项目有一个 HTTPS.js 脚本，它从 HttpUrlConnection 类挂钩到 getInputStream 和 getOutputStream。HTTPS.js 脚本成功地挂钩了这些方法，但是当发送 HTTPS 流量时，我看到的数据是加密的。

根据有关HTTPUrlConnection的 Android 文档，如果 URL.openconnection() 方法接收到 HTTPS url，它将返回一个 HTTPSUrlConnection 对象。

HttpsURLConnection的Android 文档指出它是一个扩展 HttpURLConnection 的抽象类。

公共抽象类 HttpURLConnection 扩展了 HttpURLConnection

我搜索了android源代码，发现 HttpsURLConnection 是抽象的，并且由 DelegatingHttpsURLConnection 扩展，这也是抽象的。DelegatingHttpsURLConnection 由HttpsURLConnectionImpl扩展

我已经迷上了

com.android.okhttp.internal.huc.HttpsURLConnectionImpl

这是成功的，但数据仍然是加密的。这是代码

var HttpsURLConnection = Java.use("com.android.okhttp.internal.huc.HttpsURLConnectionImpl");

HttpsURLConnection.getInputStream.overloads[0].implementation = function() {
try {
  methodURL = "";
responseHeaders = "";
responseBody = "";
var Connection = this;
var stream = stream = this.getInputStream.overloads[0].apply(this, arguments);

var requestURL = Connection.getURL().toString();
var requestMethod = Connection.getRequestMethod();
var requestProperties
methodURL = requestMethod + " " + requestURL;
if (Connection.getHeaderFields) {
  var Keys = Connection.getHeaderFields().keySet().toArray();
  var Values = Connection.getHeaderFields().values().toArray();
  responseHeaders = "";
  for (var key in Keys) {
    if (Keys[key] && Keys[key] !== null && Values[key]) {
      responseHeaders += Keys[key] + ": " + Values[key].toString().replace(/\[/gi, "").replace(/\]/gi, "") + "\n";
    } else if (Values[key]) {
      responseHeaders += Values[key].toString().replace(/\[/gi, "").replace(/\]/gi, "") + "\n";
    }
  }
}
var retval;
if (stream) {
  var baos = ByteArrayOutputStream.$new();
  var buffer = -1;

  var BufferedReaderStream = BufferedReader.$new(InputStreamReader.$new(stream));
  while ((buffer =stream.read()) != -1){
      baos.write(buffer);
      responseBody += String.fromCharCode(buffer);
   }
BufferedReaderStream.close();
baos.flush();
retval = ByteArrayInputStream.$new(baos.toByteArray());

}
/*   --- Payload Header --- */


var send_data = {};
send_data.time = new Date();
send_data.txnType = 'HTTPS';
send_data.lib = 'com.android.okhttp.internal.huc.HttpsURLConnectionImpl';
send_data.method = 'getInputStream';
send_data.artifact = [];
/*   --- Payload Body --- */
var data = {};
data.name = "Request/Response";
data.value = methodURL + "\n" + requestHeaders + "\n" + requestBody + "\n\n" + responseHeaders + "\n" + responseBody;
data.argSeq = 0;
send_data.artifact.push(data);
send(JSON.stringify(send_data));

if(retval)
    return retval;
return stream;
} catch (e) {
  this.getInputStream.overloads[0].apply(this, arguments);
}
}

顺便说一句，一旦我开始工作，我计划提交一个拉取请求。

Android 文档有一个关于如何创建 HTTP 请求的示例：

URL url = new URL("https://wikipedia.org");
URLConnection urlConnection = url.openConnection();
InputStream in = urlConnection.getInputStream();
copyInputStreamToOutputStream(in, System.out);

读到这里告诉我只调用 getInputStream() 方法应该返回明文流，但它似乎没有这样做。

问题：如何从 HTTPS 流量中获取明文数据？我可以看到标题，只是看不到实际数据

更新 10/13

我想知道我看到的数据是否没有加密，只是编码。这是我收到的数据的截图：

\\u001f\x8b\\b\\u0000\\u0000\\u0000\\u0000\\u0000\\u0004\\u0000\xed\xbd\\u0007`\\u001cI\x96%&/m\xca{\x7fJ\xf5J\xd7\xe0t\xa1\\b\x80`\\u0013$\xd8\x90@\\u0010\xec\xc1\x88\xcd\xe6\x92\xec\\u001diG#)\xab*\x81\xcaeVe]f\\u0016@\xcc\xed\x9d\xbc\xf7\xde{\xef\xbd\xf7\xde{\xef\xbd\xf7\xba;\x9dN\'\xf7\xdf\xff?\\\\fd\\u0001l\xf6\xceJ\xda\xc9\x9e!\x80\xaa\xc8\\u001f?~|\\u001f?\\"\\u001e\xff\\u001e\xef\\u0016ez\x99\xd7MQ-?\xfbhw\xbc\xf3Q\x9a/\xa7\xd5\xacX^

响应头表明它的 gzip 编码

Content-Encoding: gzip
Content-Length: 438
Content-Type: text/xml; charset=utf-8

我想知道它是否与此stackoverflow答案有关，尽管传出请求确实具有“Accept-Encoding: gzip”标头。我尝试添加对 GZIPInputStream 的调用，但应用程序不喜欢响应

更新 2 所以我能够让它捕获数据，这是 gzip 的问题。我现在遇到的问题是 Android 设备上的应用程序需要一个 GZIPed 输入流。要在 Frida 中显示数据，我必须通过 GZIPInputStream 运行它，但还不确定如何再次压缩它以发送到应用程序。我尝试使用 GZIPOutputStream 进行简短的尝试，但没有奏效。这是我更新的代码。

 HttpURLConnection.getInputStream.overloads[0].implementation = function() {    
try {
  methodURL = "";
responseHeaders = "";
responseBody = "";
var Connection = this;
if("gzip" == Connection.getContentEncoding())
{
    var stream = InputStreamReader.$new(GZIPInputStream.$new(this.getInputStream.apply(this, arguments)));
}   
else
{
    var stream = InputStreamReader.$new(this.getInputStream.apply(this, arguments));
}
}

var requestURL = Connection.getURL().toString();
var requestMethod = Connection.getRequestMethod();
var requestProperties
methodURL = requestMethod + " " + requestURL;
if (Connection.getHeaderFields) {
  var Keys = Connection.getHeaderFields().keySet().toArray();
  var Values = Connection.getHeaderFields().values().toArray();
  responseHeaders = "";
  for (var key in Keys) {
    if (Keys[key] && Keys[key] !== null && Values[key]) {
      responseHeaders += Keys[key] + ": " + Values[key].toString().replace(/\[/gi, "").replace(/\]/gi, "") + "\n";
    } else if (Values[key]) {
      responseHeaders += Values[key].toString().replace(/\[/gi, "").replace(/\]/gi, "") + "\n";
    }
  }
}
var retval;
if (stream) {
  var baos = ByteArrayOutputStream.$new();
  var buffer = -1;

  var BufferedReaderStream = BufferedReader.$new(stream);
  while ((buffer =stream.read()) != -1){
      baos.write(buffer);
      responseBody += String.fromCharCode(buffer);
   }
BufferedReaderStream.close();
baos.flush();
if("gzip" == Connection.getContentEncoding())
{
    retval = GZIPOutputStream.$new(ByteArrayInputStream.$new(baos.toByteArray()));
}
else
{
    retval = ByteArrayInputStream.$new(baos.toByteArray());
}


}
/*   --- Payload Header --- */


var send_data = {};
send_data.time = new Date();
send_data.txnType = 'HTTP';
send_data.lib = 'com.android.okhttp.internal.http.HttpURLConnectionImpl';
send_data.method = 'getInputStream';
send_data.artifact = [];
/*   --- Payload Body --- */
var data = {};
data.name = "Request/Response";
data.value = methodURL + "\n" + requestHeaders + "\n" + requestBody + "\n\n" + responseHeaders + "\n" + responseBody;
data.argSeq = 0;
send_data.artifact.push(data);
send(JSON.stringify(send_data));

if(retval)
    return retval;
return stream;
} catch (e) {
  this.getInputStream.overloads[0].apply(this, arguments);
}
}
4

0 回答 0