用frida突破SSL pinning抓包

最新推荐文章于 2026-08-13 15:40:11 发布

原创

最新推荐文章于 2026-08-13 15:40:11 发布 · 5.3k 阅读

本文介绍如何使用Frida工具绕过Android应用中的SSL Pinning安全机制，包括针对不同网络库和API的hook策略，以及如何利用自定义TrustManager和HostnameVerifier实现这一目标。

python任意版本安装frida,手机端使用的mumu模拟器,其他的也可以

pip install frida

adb 连接 mumu模拟器

查看内核

adb shell 
su
cat /proc/cupinfo
或者
adb shell getprop ro.product.cpu.abi

模拟器一般是x86居多

根据cpu版本去下载相应frida-server，然后去下载 https://github.com/frida/frida/releases相应的版本

之后解压处理将文件push 进 /data/local/tmp 这个目录

adb push .\frida-server-12.10.4-android-x86 /data/local/tmp/frida-server

之后需要设置权限，就可以测试frida

测试命令：./frida-server

之后另外开启一个命令窗口运行命令：frida-ps -U

就可以hook进程了

部分不能正常charles抓包的APP打开后

命令输入:

frida -U com.gaana —no-pause -l hook.js

就可以抓包

Java.perform(function() {

/*
hook list:
1.SSLcontext
2.okhttp
3.webview
4.XUtils
5.httpclientandroidlib
6.JSSE
7.network\_security\_config (android 7.0+)
8.Apache Http client (support partly)
9.OpenSSLSocketImpl
10.TrustKit
11.Cronet
*/

	// Attempts to bypass SSL pinning implementations in a number of
	// ways. These include implementing a new TrustManager that will
	// accept any SSL certificate, overriding OkHTTP v3 check()
	// method etc.
	var X509TrustManager = Java.use('javax.net.ssl.X509TrustManager');
	var HostnameVerifier = Java.use('javax.net.ssl.HostnameVerifier');
	var SSLContext = Java.use('javax.net.ssl.SSLContext');
	var quiet_output = false;

	// Helper method to honor the quiet flag.

	function quiet_send(data) {

		if (quiet_output) {

			return;
		}

		send(data)
	}


	// Implement a new TrustManager
	// ref: https://gist.github.com/oleavr/3ca67a173ff7d207c6b8c3b0ca65a9d8
	// Java.registerClass() is only supported on ART for now(201803). 所以android 4.4以下不兼容,4.4要切换成ART使用.
	/*
06-07 16:15:38.541 27021-27073/mi.sslpinningdemo W/System.err: java.lang.IllegalArgumentException: Required method checkServerTrusted(X509Certificate[], String, String, String) missing
06-07 16:15:38.542 27021-27073/mi.sslpinningdemo W/System.err:     at android.net.http.X509TrustManagerExtensions.<init>(X509TrustManagerExtensions.java:73)
        at mi.ssl.MiPinningTrustManger.<init>(MiPinningTrustManger.java:61)
06-07 16:15:38.543 27021-27073/mi.sslpinningdemo W/System.err:     at mi.sslpinningdemo.OkHttpUtil.getSecPinningClient(OkHttpUtil.java:112)
        at mi.sslpinningdemo.OkHttpUtil.get(OkHttpUtil.java:62)
        at mi.sslpinningde