有什么网站交互做的很好 知乎,dedeampz 安装wordpress教程,抖音十大传媒公司名称,如何弄公司网站本篇主要用来完善上篇文章 frida 监测网络请求的.
whatsapp相关(五)- frida监测网络请求
1: 脚本
本次的脚本与上次的区别是,之前只能输出请求的地址,本次优化后,可输出请求参数,结果等.
代码如下:
Java.perform(function () {var HttpURLConnection Java.use(java.net.H…本篇主要用来完善上篇文章 frida 监测网络请求的.
whatsapp相关(五)- frida监测网络请求
1: 脚本
本次的脚本与上次的区别是,之前只能输出请求的地址,本次优化后,可输出请求参数,结果等.
代码如下:
Java.perform(function () {var HttpURLConnection Java.use(java.net.HttpURLConnection);var URL Java.use(java.net.URL);var Proxy Java.use(java.net.Proxy);var originalOpenConnection URL.openConnection;URL.openConnection.overload().implementation function () {var connection originalOpenConnection.call(this);console.log(URL.openConnection called: this.toString());return connection;};var HttpURLConnectionImpl Java.use(com.android.okhttp.internal.huc.HttpURLConnectionImpl);HttpURLConnectionImpl.connect.overload().implementation function () {console.log(connect());HttpURLConnectionImpl.connect.call(this);};HttpURLConnectionImpl.setRequestProperty.implementation function(name,value){console.log(setRequestProperty ,name,: ,value);return this.setRequestProperty(name,value);};HttpURLConnectionImpl.setRequestMethod.implementation function(type){console.log(setRequestMethod : ,type);return this.setRequestMethod(type);};HttpURLConnectionImpl.responseSourceHeader.implementation function(response){var result this.responseSourceHeader(response);console.log(responseSourceHeader : result);return result;};HttpURLConnectionImpl.getResponseCode.overload().implementation function(){var code this.getResponseCode();console.log(getResponseCode : code);return code;};HttpURLConnectionImpl.setConnectTimeout.overload(int).implementation function(time){console.log(setConnectTimeout : time);return this.setConnectTimeout(time);};var testInput;HttpURLConnectionImpl.getInputStream.overload().implementation function () {var returnStream HttpURLConnectionImpl.getInputStream.call(this);testInput returnStream;var inputStr readInputStream(testInput);console.log(getInputStream(): inputStr);return returnStream;};#打印inputStreamfunction readInputStream(inputStream){var str ;if(inputStream null){console.log(inputStream is null);return str;}try{var inputStreamReader Java.use(java.io.InputStreamReader).$new(inputStream ,UTF-8);var bufferedReader Java.use(java.io.BufferedReader).$new(inputStreamReader);var response Java.use(java.lang.StringBuffer).$new();var line null;while((line bufferedReader.readLine()) ! null){response.append(line);}bufferedReader.close();str response;}catch(error){console.error( inputstream error: error);return null;}return str;}
});由于HttpURLConnection 是抽象类,所以直接打印的HttpURLConnection方法无法输出数据.
我们找到HttpURLConnection的子类HttpURLConnectionImpl .从而获取相关的数据输出.
2: 测试
执行脚本:
frida -U -f com.whatsapp -l /home/zh/workSpace/test/Xpose/app/src/main/java/com/zh/xpose/js/url.js ____/ _ | Frida 16.0.2 - A world-class dynamic instrumentation toolkit| (_| | _ | Commands:/_/ |_| help - Displays the help system. . . . object? - Display information about object. . . . exit/quit - Exit. . . .. . . . More info at https://frida.re/docs/home/. . . .. . . . Connected to xxx (id6b4a96b2)
Spawned com.whatsapp. Resuming main thread! 启动whatsapp后: [xxx::com.whatsapp ]- URL.openConnection called: https://graph.whatsapp.com/graphql
setConnectTimeout : 15000
setRequestProperty User-Agent : WhatsApp/xxx Android/10 Device/LeEco-xxx [FBAN/WhatsAppAndroid;FBAV/xxx;FBLC/zh_CN;FBSV/10;FBBR/msm8996;FBBD/LeEco;FBBV/240175000;FBCA/arm64-v8a:;FBPN/com.whatsapp;FBDM/DisplayMetrics{density3.5, width1440, height2560, scaledDensity3.5, xdpi537.882, ydpi537.388};]
setRequestMethod : POST
setRequestProperty Content-Type : application/json
setRequestProperty Content-Encoding : gzip
connect()
responseSourceHeader : NETWORK 200
getInputStream(): {data:{avatar_static_config:{id:711543810765370}},extensions:{is_final:true}}URL.openConnection called: http://clients3.google.com/generate_204
setConnectTimeout : 10000
URL.openConnection called: https://www.whatsapp.com/android/3/WhatsApp.version
setConnectTimeout : 15000
setRequestProperty User-Agent : WhatsApp/xxx Android/10 Device/LeEco-xxx
setRequestProperty Accept-Charset : UTF-8
getInputStream():
getResponseCode : 204
getResponseCode : 200
getInputStream(): pre styleword-wrap: break-word; white-space: pre-wrap;2.24.2.77/pre
有兴趣加下订阅号,新文章推送:
