抓包：Android对抗证书校验

最新推荐文章于 2026-04-11 08:30:00 发布

原创

最新推荐文章于 2026-04-11 08:30:00 发布 · 3.8k 阅读

标签

#网络 #android #安全 #经验分享

本文详细介绍了Android客户端如何进行HTTPS单向验证，包括使用X509TrustManager和HostnameVerifier进行证书校验，并通过Frida Hook绕过验证。同时，文章还展示了服务端单向验证的处理方式，以及如何解决Charles抓包时的证书问题。通过实例代码和Hook策略，深入理解HTTPS安全机制。

Android客户端单向验证

客户端单向验证手段很多，可以参考JustTrustMe，SSLKiller 之类的Hook框架源码去探索，这里选取几个常用的API讲解。
这里我们依旧拿 https://tcc.taobao.com/cc/json/mobile_tel_segment.htm?tel=XXX 接口做测试，首先代码里嵌入证书（下面代码中的 TAOBAO_CERTIFICATE 变量）用来做校验：

public final static String TAOBAO_CERTIFICATE = "-----BEGIN CERTIFICATE-----\n" +
        "MIIeCzCCHPOgAwIBAgIMUsU3P5Y0P8vdHcZnMA0GCSqGSIb3DQEBCwUAMGYxCzAJ\n" +
        "BgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMTwwOgYDVQQDEzNH\n" +
        ...此处省略百来行...
        "GwQ/XhBRqDw9PZIlGokmQEjKrHTA1/F3a7ZI4penyDeIVP5Qcum0IBFbZl1vaxSf\n" +
        "zSg424KuPxlXi6ivheAC\n" +
        "-----END CERTIFICATE-----\n";

X509TrustManager

从下面代码中不难看出证书验证逻辑都在X509TrustManager的方法中：

//HttpsURLConnection请求https://tcc.taobao.com/cc/json/mobile_tel_segment.htm?tel=13999999999
public void getHtmlByHttpsUrlconnection(String path) throws Exception {
   
   
    URL url = new URL(path);
    HttpsURLConnection conn = (HttpsURLConnection) url.openConnection();
    conn.setDoOutput(true);
    conn.setDoInput(true);
    conn.setConnectTimeout(3000);
    conn.setSSLSocketFactory(getSSLContext().getSocketFactory()); //关键在这里

    if (conn.getResponseCode() == 200) {
   
   
        InputStream inStream = conn.getInputStream();
        ByteArrayOutputStream outStream = new ByteArrayOutputStream();
        byte[] buffer = new byte[1024];
        int len = 0;
        while ((len = inStream.read(buffer)) != -1) {
   
   
            outStream.write(buffer, 0, len);
        }
        inStream.close();
        String res = new String(outStream.toByteArray(), "GBK");
        Log.d("GRAB", res);
    }
}

private static SSLContext getSSLContext() {
   
   
    X509TrustManager x509TrustManager = new X509TrustManager() {
   
   

        /**
         * 校验服务端证书
         * @param chain 证书链（不包含根证书）
         * @param authType 算法类型
         * @throws CertificateException
         */
        @Override
        public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException {
   
   
            if (chain == null || chain.length <= 0) {
   
   
                throw new CertificateException("没证书");
            }
            if (TextUtils.isEmpty(authType) || authType.toUpperCase().contains("RSA"<

最低0.47元/天解锁文章