wooyundota / droidsslunpinning Goto Github PK

View Code? Open in Web Editor NEW

1.3K 35.0 326.0 1.81 MB

Android certificate pinning disable tools

JavaScript 100.00%

droidsslunpinning's Introduction

安卓证书锁定解除的工具

经常有朋友问我,手机安装代理证书后这个app的https流量依然抓不到明文包该如何操作,这种情况基本是遇到证书锁定了,分享下我的操作.

目录ObjectionUnpinningPlus增加了ObjectionUnpinning没覆盖到的锁定场景.(objection)
- 使用方法1 attach : frida -U com.example.mennomorsink.webviewtest2 --no-pause -l hooks.js
- 使用方法2 spawn : frida -U -f com.example.mennomorsink.webviewtest2 -l hooks.js --no-pause
- 更为详细使用方法:参考我的文章 Frida.Android.Practice(ssl unpinning) 实战ssl pinning bypass 章节 .
ObjectionUnpinningPlus hook list:
- SSLcontext(ART only)
- okhttp
- webview
- XUtils(ART only)
- httpclientandroidlib
- JSSE
- network_security_config (android 7.0+)
- Apache Http client (support partly)
- OpenSSLSocketImpl
- TrustKit
- Cronet
若有没有覆盖到的场景可以联系我微博https://weibo.com/luoding1991.
如遇双向锁定即客户端锁定后服务端也对客户端证书验证checkClientTrusted,还需将证书文件导入代理软件,可能会有密码但必然会存在客户端中.
xposed版本直接使用 https://github.com/Fuzion24/JustTrustMe 建议自己编译.

droidsslunpinning's People

Contributors

Stargazers

Watchers

Forkers

peterdocter fishso wangzh7678 aetkrad badboy3000 5up3rc androiddream breagitt weieast iph0n3 zhanglang001 n1ckl32 exiahan rockystevejobs butterflyhack secice blackluny zhengxyzw xxxyanchenxxx chago whoami404 democrc xiaoshuier useafter yb1994917 darktemple9 srdr0p fzxcp3 inarcissuss deelmind crackercat iicoming wooyunvip zhangmiaoping23 shuixi2013 saliey linvex kungia09 vaginessa hy-nk focuspadding aptkid fruittang jjsmida sry309 yuknight harry1080 mickeystone jwx0539 mz135135 zhencang 26597925 bigfacecat2017 vsirer bbghunter enjoymiracle zzy165200 killvxk slowmistio 0x24bin soviet1942 dash-remi orf53975 zhengyuqin m4d3bug spr1ngbr0ther molongwudi seuercc parkerpeng xufengnian dddddz wha000tif lightflyer piowind tnoa77 h2zzhou zxhubo raindrop4steven lemniscate317 gamegrd fakegit imklever fanliugen coolsnake nicholas1126 zihao2015 w7yuu jumbo-wjb cxapython yuaotian githubsectest owlwang jiaodalpp comewhere vo1d bravery9 chenzhuo09 howarliu hkylin raystyle

droidsslunpinning's Issues

大佬，frida怎么使用getDeclaredMethod

例如有个java函数是：

public byte[] aesEncrypt(String plaintext)

我想在frida上面用js反射调用，那么

var class_name1 = "com.example.cryptutils.util.CryptoUtils";
var Platform1  = Java.use(class_name1);
var t=Java.use("java.lang.String");
var method = Platform1.class.getDeclaredMethod("aesEncrypt",XXXX);

我想问一下，xxxx这里的参数类型该如何填写呢，在java下调用我知道直接填写String.class就好了，但是在frida下各种姿势都试过了，没搞掂。

How to create a Integer.TYPE(int.class) array?

https://github.com/frida/frida-java/issues/78,大佬，这个问题知道咋个解决的吗。

app被加固，提示Failed to attach: timed out while waiting for session to establish

大神，请问下JustTrustMe对多dex的apk有影响吗？

SSLContext

博客var SSLContext_init = SSLContext.init.overload中的sslcontext是
Hookvar SSLContext = Java.use("javax.net.ssl.SSLContext");吗？？

翼支付抓不了

翼支付APP抓不了，https://www.wandoujia.com/apps/280379

怎么使用frida来hook nativ函数的jstring返回值

#define  LOGI(...)  __android_log_print(ANDROID_LOG_INFO, "hooktest", __VA_ARGS__)
int getInt(int i)
{
    return i+99;
}

extern "C"   JNIEXPORT jstring   JNICALL Java_mi_ndk4frida_MainActivity_stringFromJNI(
        JNIEnv *env,
        jobject /* this */) {
    LOGI("[+] %d\n", getInt(2));
    return env->NewStringUTF("Hello from C++");
}

上面是示例代码，连接是这个https://xz.aliyun.com/t/2336，网上google了很多，hook native函数，都是修改返回值为int 这样的类型。那么怎么去hook NICALL Java_mi_ndk4frida_MainActivity_stringFromJNI函数修改返回值呢，其实就是修改 return env->NewStringUTF("Hello from C++"); 的值呢。

hook后 app 请求会失败

message: {'type': 'send', 'payload': 'HttpsURLConnection.setDefaultHostnameVerifier invoked'} data: None
Error: Implementation for setDefaultHostnameVerifier expected return value compatible with void
    at ne (frida/node_modules/frida-java-bridge/lib/class-factory.js:621)
    at <anonymous> (frida/node_modules/frida-java-bridge/lib/class-factory.js:598)
message: {'type': 'send', 'payload': 'Overriding SSLContext.init() with the custom TrustManager'} data: None
message: {'type': 'send', 'payload': 'HttpsURLConnection.setDefaultHostnameVerifier invoked'} data: None
Error: Implementation for setDefaultHostnameVerifier expected return value compatible with void
    at ne (frida/node_modules/frida-java-bridge/lib/class-factory.js:621)
    at <anonymous> (frida/node_modules/frida-java-bridge/lib/class-factory.js:598)
message: {'type': 'send', 'payload': 'Overriding SSLContext.init() with the custom TrustManager'} data: None
message: {'type': 'send', 'payload': 'OkHTTP 3.x check() called. Not throwing an exception.'} data: None
message: {'type': 'send', 'payload': 'OkHTTP 3.x check() called. Not throwing an exception.'} data: None
message: {'type': 'send', 'payload': 'OkHTTP 3.x check() called. Not throwing an exception.'} data: None
message: {'type': 'send', 'payload': 'OkHTTP 3.x check() called. Not throwing an exception.'} data: None
message: {'type': 'send', 'payload': 'TrustManagerImpl verifyChain called'} data: None
message: {'type': 'send', 'payload': 'OkHTTP 3.x check() called. Not throwing an exception.'} data: None
message: {'type': 'send', 'payload': 'OkHTTP 3.x check() called. Not throwing an exception.'} data: None

请问一下我运行hooks.js出现以下错误应该如何解决

E:\pychram\FridaProject>frida -U com.amahua.ompimdrt --no-pause -l hooks.js
____
/ _ | Frida 12.2.26 - A world-class dynamic instrumentation toolkit
| (| |
> _ | Commands:
// |_| help -> Displays the help system
. . . . object? -> Display information about 'object'
. . . . exit/quit -> Exit
. . . .
. . . . More info at http://www.frida.re/docs/home/
Attaching...
OkHTTP 3.x Found
com.squareup.okhttp not found
Xutils hooks not Found
httpclientandroidlib Hooks not found
TrustManagerImpl verifyChain nout found below 7.0
message: {'type': 'send', 'payload': 'Custom, Empty TrustManager ready'} data: None
[Xiaomi MI 3W::com.amahua.ompimdrt]->

我安装的是你目录下的just trust me
小白不太懂望解答

wooyundota / droidsslunpinning Goto Github PK

droidsslunpinning's Introduction

安卓证书锁定解除的工具

droidsslunpinning's People

Contributors

Stargazers

Watchers

Forkers

droidsslunpinning's Issues

大佬，frida怎么使用getDeclaredMethod

How to create a Integer.TYPE(int.class) array?

app被加固，提示Failed to attach: timed out while waiting for session to establish

大神，请问下JustTrustMe对多dex的apk有影响吗？

SSLContext

翼支付抓不了

怎么使用frida来hook nativ函数的jstring返回值

hook后 app 请求会失败

请问一下我运行hooks.js出现以下错误应该如何解决

Recommend Projects

React

Vue.js

Typescript

TensorFlow

Django

Laravel

D3

Recommend Topics

javascript

web

server

Machine learning

Visualization

Game

Recommend Org

Facebook

Microsoft

Google

Alibaba

D3

Tencent