如何自定义CA证书

package com.example.customssl;import android.content.Context;
import org.apache.http.client.HttpClient;
import org.apache.http.conn.scheme.PlainSocketFactory;
import org.apache.http.conn.scheme.Scheme;
import org.apache.http.conn.scheme.SchemeRegistry;
import org.apache.http.conn.ssl.AllowAllHostnameVerifier;
import org.apache.http.conn.ssl.SSLSocketFactory;
import org.apache.http.impl.client.DefaultHttpClient;
import org.apache.http.impl.conn.tsccm.ThreadSafeClientConnManager;
import org.apache.http.params.BasicHttpParams;
import org.apache.http.params.HttpParams;import javax.net.ssl.HttpsURLConnection;
import javax.net.ssl.SSLContext;
import javax.net.ssl.TrustManagerFactory;
import java.io.IOException;
import java.io.InputStream;
import java.net.URL;
import java.security.KeyStore;
import java.security.KeyStoreException;
import java.security.NoSuchAlgorithmException;
import java.security.cert.Certificate;
import java.security.cert.CertificateException;
import java.security.cert.CertificateFactory;public class CustomCAHttpsProvider {/*** Creates a {@link org.apache.http.client.HttpClient} which is configured to work with a custom authority* certificate.** @param context       Application Context* @param certRawResId  R.raw.id of certificate file (*.crt). Should be stored in /res/raw.* @param allowAllHosts If true then client will not check server against host names of certificate.* @return Http Client.* @throws Exception If there is an error initializing the client.*/public static HttpClient getHttpClient(Context context, int certRawResId, boolean allowAllHosts) throws Exception {// build key store with ca certificateKeyStore keyStore = buildKeyStore(context, certRawResId);// init ssl socket factory with key storeSSLSocketFactory sslSocketFactory = new SSLSocketFactory(keyStore);// skip hostname security check if specifiedif (allowAllHosts) {sslSocketFactory.setHostnameVerifier(new AllowAllHostnameVerifier());}// basic http params for clientHttpParams params = new BasicHttpParams();// normal scheme registry with our ssl socket factory for "https"SchemeRegistry schemeRegistry = new SchemeRegistry();schemeRegistry.register(new Scheme("http", PlainSocketFactory.getSocketFactory(), 80));schemeRegistry.register(new Scheme("https", sslSocketFactory, 443));// create connection managerThreadSafeClientConnManager cm = new ThreadSafeClientConnManager(params, schemeRegistry);// create http clientreturn new DefaultHttpClient(cm, params);}/*** Creates a {@link javax.net.ssl.HttpsURLConnection} which is configured to work with a custom authority* certificate.** @param urlString     remote url string.* @param context       Application Context* @param certRawResId  R.raw.id of certificate file (*.crt). Should be stored in /res/raw.* @param allowAllHosts If true then client will not check server against host names of certificate.* @return Http url connection.* @throws Exception If there is an error initializing the connection.*/public static HttpsURLConnection getHttpsUrlConnection(String urlString, Context context, int certRawResId,boolean allowAllHosts) throws Exception {// build key store with ca certificateKeyStore keyStore = buildKeyStore(context, certRawResId);// Create a TrustManager that trusts the CAs in our KeyStoreString tmfAlgorithm = TrustManagerFactory.getDefaultAlgorithm();TrustManagerFactory tmf = TrustManagerFactory.getInstance(tmfAlgorithm);tmf.init(keyStore);// Create an SSLContext that uses our TrustManagerSSLContext sslContext = SSLContext.getInstance("TLS");sslContext.init(null, tmf.getTrustManagers(), null);// Create a connection from urlURL url = new URL(urlString);HttpsURLConnection urlConnection = (HttpsURLConnection) url.openConnection();urlConnection.setSSLSocketFactory(sslContext.getSocketFactory());// skip hostname security check if specifiedif (allowAllHosts) {urlConnection.setHostnameVerifier(new AllowAllHostnameVerifier());}return urlConnection;}private static KeyStore buildKeyStore(Context context, int certRawResId) throws KeyStoreException, CertificateException, NoSuchAlgorithmException, IOException {// init a default key storeString keyStoreType = KeyStore.getDefaultType();KeyStore keyStore = KeyStore.getInstance(keyStoreType);keyStore.load(null, null);// read and add certificate authorityCertificate cert = readCert(context, certRawResId);keyStore.setCertificateEntry("ca", cert);return keyStore;}private static Certificate readCert(Context context, int certResourceId) throws CertificateException, IOException {// read certificate resourceInputStream caInput = context.getResources().openRawResource(certResourceId);Certificate ca;try {// generate a certificateCertificateFactory cf = CertificateFactory.getInstance("X.509");ca = cf.generateCertificate(caInput);} finally {caInput.close();}return ca;}}

Frida 拦截

Java.perform(function () {const CertificateFactory = Java.use('java.security.cert.CertificateFactory')const certList = [];CertificateFactory.getInstance.overload('java.lang.String').implementation=function (type) {certList[Thread.currentThread().getId()]=typereturn this.getInstance(type)}
CertificateFactory.generateCertificate.overload('java.io.InputStream').implementation=function (input) {var type= certList[Thread.currentThread().getId()]console.log("type:",type)console.log("hex:\n",input)console.log("hex:\n",tool.Hexdump(tool.FridaTool().readBin(input)))return this.generateCertificate(input)}});

参考

https://stackoverflow.com/a/23697732/12457105

Android逆向之CA证书提取相关推荐

Android——自建CA证书，实现https请求
Android 使用https 协议请求客户端 server端操作自己创建 CA 证书拿自建CA 证书创建 server 端证书创建 https 服务 Android客户端操作创建项目并引入相 ...
eap wifi 证书_如何以编程方式在Android中安装CA证书（用于EAP WiFi配置）？
我的目标:在Android programmitcally中创建一个EAP WiFi配置 - 包括CA证书 . 问题:如何以编程方式安装CA证书(然后在EAP WiFi配置中引用该证书)? 但是,假设 ...
eap方法华为手机怎么连wifi_如何以编程方式在Android中安装CA证书(用于EAP WiFi配置)？...
我的目标: 在 Android programmitcally中创建EAP WiFi配置 – 包括CA证书. 问题: 如何以编程方式安装CA证书(然后在EAP WiFi配置中引用该证书)? 但是,这假 ...
【Android 逆向】APK 文件格式 ( Android 应用安装 | Zip 文件格式 | 使用 Python 代码提取 APK 文件 )
文章目录一.Android 应用安装二.APK 文件格式三.使用 Python 提取 APK 文件一.Android 应用安装 APK 是 Android 应用的安装文件 , 现在也有 AAB ...
【SSL】openssl 提取 PKCS 证书库中的公钥、私钥、证书、密钥、CA证书
前言 openssl 1.1.1g 证书库格式 PKCS12 测试证书库 test.pfx .该证书库仅有一套证书(多套证书公用一个证书库的情况未测试). 查看证书库 openssl pkcs12 - ...
android系统证书导入工具,如何将CA证书导入Android手机？
我想使用Nexus One连接到大学的无线网络.当我转到"无线设置"中的"添加Wi-Fi网络"时,我填写网络SSID并选择802.1x Enterprise作为 ...
Android https 自签名和CA证书验证（基于OkHttp）
Android HTTPS自签名和CA证书验证(基于OkHttp) HTTPS介绍 CA证书自签名证书问题描述域名校验 OkHttp设置总结 HTTPS介绍 HTTPS是一种通过计算机网络进行 ...
OpenSSL生成CA自签名根证书和颁发证书和证书提取
CA根证书生成流程第一步生成CA证书私钥 1.#生成ca私钥 (.key 和 pem 只是格式不一样) openssl genrsa -aes128 -passout pass:Test@202 ...
教你如何将CA证书导入Android手机
第一:Android只能理解CA的二进制格式,只能使用文件格式* .crt. 第二:Android只能理解* .p12文件格式的用户证书. 因此,您可以检查您的CA文件二进制文件或文本是否非常简单:使 ...

Android逆向之CA证书提取

如何自定义CA证书

Frida 拦截

参考

Android逆向之CA证书提取相关推荐

最新文章

热门文章