2021Android网络库详解技术

PAGEPAGE10Android⽹络库详解-tale⽹络库：HttpURLConnectionHttpURLConnection介绍HttpURLConnection的使⽤步骤HOOKHttpURLConnection⽹络库：okhttp3+loggingOKHttp简介OKHttp的功能HOOKOkHttp3⽹络库:RetrofitRetrofit简介：Retrofit使⽤步骤HOOKRetrofit参考资料⽹络库：HttpURLConnectionHttpURLConnection介绍⼀种多⽤途轻量极的HTTP客户端，使⽤它来进⾏HTTP操作可以适⽤于⼤多数的应⽤程序虽然HttpURLConnection的API提供的⽐较简单，但是同时这也使得我们可以更加容易地去使⽤和扩展它继承⾄URLConnection，抽象类，⽆法直接实例化对象通过调⽤openCollection()⽅法获得对象实例，默认是带gzip压缩的；HttpURLConnection的使⽤步骤使⽤HttpURLConnection的步骤如下：PlainTextPlainText复制代码1创建⼀个URL对象：URLurlnewURL();2调⽤URL对象的openConnection(来获取HttpURLConnection对象实例：HttpURLConnectionconn=(HttpURLConnection)url.openConnection();3设置HTTP请求使⽤的⽅法:GET或者POST，或者其他请求⽅式⽐如：PUTconn.setRequestMethod("GET");4设置连接超时，读取超时的毫秒数，以及服务器希望得到的⼀些消息头conn.setConnectTimeout(6*1000);conn.setReadTimeout(6*1000);5调⽤getInputStream()⽅法获得服务器返回的输⼊流，然后输⼊流进⾏读取InputStreamin=conn.getInputStream();6最后调⽤disconnect()⽅法将HTTP连conn.disconnect();HOOKHttpURLConnectionPlainText复制代码1创建⼀个URL对象：URLurl=newURL();URL()如果想⾃吐URL()

则应该hookURL的构造函数PlainTextPlainText复制代码1 workon(google:8.1.0)[usb]#androidhookingsearchclassesURL.URL.$init需单独hook构造函数.URL.$initPlainTextPlainText复制代码workon(google:8.1.0)[usb]#androidhookingwatchmethod.URL.$init--dump-args--dump-backtrace--dump-return可以发现在⼿机每点击⼀下刷新验证码，就会弹出新的请求然后可以编写⾃吐脚本，打印出经过的url地址PlainText复制代码1frida-U-fwork-l20201013.js--no-pause使⽤该⾃吐脚本尝试另⼀款APP做实验PlainText复制代码1frida-U-fcom.cz.babySister-l20201013.js--no-pausejava.io.PrintWriterhook 的write⽅法打印出内容：java.io.PrintWriterPlainTextPlainText复制代码com.cz.babySisteron(google:8.1.0)[usb]#androidhookingwatchclass_methodjava.io.PrintWriter.write--dump-args--dump-backtrace--dump-returnjava.io.PrintWriter.write编写hook脚本将和密码java.io.PrintWriter.writeHttpURLConnection最终HttpURLConnection

⾃吐脚本如下

内容进⾏打印，可以发现显示出了⽤户输⼊的账号JavaScript 复制代码1 functionhook_HttpUrlConnection(){2Java.perform(function(){//.URL.URL($init)(得到5 tion=function(str){varresult=this.$init(str)console.log("result,str=>",result,str);return10 }11//HttpURLConnectionsetRequestProperty得到各种请求头属性等equestProperty.implementation=function(str1,str2){varresult=this.setRequestProperty(str1,str2); console.log(".setRequestPropertyresult,str1,str2->",result,str1,str2);return17 }18 equestMethod.implementation=function(str1){varresult=this.setRequestMethod(str1);console.log(".setRequestMethodresult,str1,str2->",result,str1);return23 }//java.io.PrintWriterwrite得到输⼊内容lementation=function(str1){varresult=this.write(str1);console.log(".writeresult,str1->",result,str1);return29 }30313233 })3435 }36 setImmediate(hook_HttpUrlConnection)⽹络库：okhttp3+loggingOKHttp简介OKHttp是⼀个处理⽹络请求的开源项⽬，Android当前最⽕热⽹络框架OKHttp的功能1PUT，DELETE，POST，GET等请求2⽂件的上传下载3加载图⽚(内部会图⽚⼤⼩⾃动压缩)4⽀持请求回调，直接返回对象对象集合5⽀持session的保持HOOKOkHttp31OkhttpClient对象exampleOkhttpClient对象在 类创exampleOkhttpClient对象PlainTextPlainText复制代码1 OkHttpClientclient=newOkHttpClient();okhttp3.OkHttpClient可以使⽤objection查找该 实例，并查看该属性域和⽅法okhttp3.OkHttpClientPlainTextPlainText复制代码com.roysue.octolesson2ok3on(google:8.1.0)[usb]#pluginload/Users/tale/.objection/plugins/WallbreakerLoadedplugin:wallbreakercom.roysue.octolesson2ok3on(google:8.1.0)[usb]#pluginwallbreakerasssearchOkHttpClientcom.android.okhttp.OkHttpClient$1com.android.okhttp.OkHttpClientokhttp3.OkHttpClient$1okhttp3.OkHttpClient$Builderokhttp3.OkHttpClientcom.roysue.octolesson2ok3on(google:8.1.0)[usb]#pluginwallbreakerjectsearchokhttp3.OkHttpClient[0x26c2]:okhttp3.OkHttpClient@dc28b06com.roysue.octolesson2ok3on(google:8.1.0)[usb]#pluginwallbreakerjectdump--fullname0x26c22Request对象JavaJava复制代码//构造requestRequestrequest=newRequest.Builder().url(url).build();ernal.huc.HttpURLConnectionIernal.huc.HttpURLConnectionImpl发现每点击刷新⼀下，会增加⼀新的实例，然后可以去查看该域3发起异步请求在将Request对象封装成Call对象后，每次enqueue都会产⽣⼀次真实的⽹络请求JavaJava复制代码123456789//发起异步请求client.newCall(request).enqueue(newCallback(){@OverridepublicvoidonFailure(Callcall,IOExceptione){call.cancel();}@OverridepublicvoidonResponse(Callcall,Responseresponse)throwsIOException{101112131415//打印输出Log.d(TAG,response.body().string());}}Java 复制代码1 publicclassexample2//TAG即为⽇志打印时的标签privatestaticStringTAG=56//新建⼀个Okhttp客户端//OkHttpClientclient=newOkHttpClient();OkHttpClientclient=newOkHttpClient.Builder().addNetworkInterceptor(newLoggingInterceptor()).build();12voidrun(Stringurl)throwsIOException{//构造requestRequestrequest=newRequest.Builder().url(url).build();1819//发起异步请求client.newCall(request).enqueue(newCallback(){@OverridepublicvoidonFailure(Callcall,IOExceptione){call.cancel();25 }26@OverridepublicvoidonResponse(Callcall,Responseresponse)throwsIOException{29//打印输出Log.d(TAG,response.body().string());3233 }34 }35 );36 }37 }做完混淆，通过拦截器分析⽅法失效⽹络库:RetrofitRetrofit简介：Retrofit是⼀个RESTful的HTTP⽹络请求框架的封装，⽹络请求的⼯作本质上是OkHttp完成，⽽Retrofit仅负责⽹络请求接⼝的封装Retrofit使⽤步骤：添加Retrofit库的依赖：PlainTextPlainText复制代码implementation'com.squareup.retrofit2:retrofit:2.5.0'//Retrofit依赖implementation'com.squareup.retrofit2:converter-gson:2.5.0'//可选依赖解析on字符所⽤⽹络权限：PlainTextPlainText复制代码1 <uses-permissionandroid:name="android.permission.INTERNET"/>创建⽤于描述⽹络请求的接⼝Retrofit将Http请求抽象成Java接⼝：采⽤注解描述⽹络请求参数和配置⽹络请求参数PlainTextPlainText复制代码1 publicinterfaceGetRequest_Interface23456789@GET("openapi.do?keyfrom=abc&key=2032414398&type=data&doctype=json&version=1.1&q=car")Call<Reception>getCall(@Field("name")Stringname);//@GET注解的作⽤:采⽤Get⽅法发送⽹络请求//getCall()=接收⽹络请求数据的⽅法//其中返回类型为Call<*>，*是接收数据的类（即上⾯定义的Translation类）//如果想直接获得Responsebody中的内容，可以定义⽹络请求返回值为Call<ResponseBody>10 }创建Retrofit实例PlainTextPlainText复制代码Retrofitretrofit=newRetrofit.Builder().baseUrl("/")//设置⽹络请求的Url地址 .addConverterFactory(GsonConverterFactory.create())//据解析器.addCallAdapterFactory(RxJavaCallAdapterFactory.create()).build();发送请求PlainTextPlainText复制代码12345678910111213141516171819202122232425//创建⽹络请求接⼝的实例GetRequest_Interfacerequest=retrofit.create(GetRequest_Interface.class);//对发送请求进⾏封装Call<Reception>call=request.getCall("");call.enqueue(newCallback<Reception>(){//请求成功时回调@OverridepublicvoidonResponse(Call<Reception>call,Response<Recep