Shulou(Shulou.com)06/01 Report--

What this article shares with you is about how to solve the problems of APP bag grabbing. The editor thinks it is very practical, so I share it with you to learn. I hope you can get something after reading this article.

One: Overview

When testing APP, we need to grab the packets of http (s) protocol. If the APP is not protected, we can directly set the proxy on the wifi of the phone as the ip and port of the packet grabbing tool. The https certificate installed on the mobile phone is the same as on the computer.

There was nothing to do during the holiday yesterday. I saw an activity, tested the APP, and then configured the agent as usual. when I opened the APP, a "I X" galloped past. The picture is as follows:

It completely detected that I had failed the agent and guessed that it might be the system call of the client remote support to detect whether the agent was hung up in the network, or the two-way authentication of https.

Second: solve

Try one: grab the package on the VPN server by turning on VPN for your phone. The attempt ended in failure.

Try 2: since you can't make an article on the system, do an article on the process.

It is not very convenient to do on the mobile phone, so I thought of installing a simulator on the computer. If you choose the simulator, you can go simply and stably. On the Internet, many people recommend using a certain god to find that this product still has to rely on virtual box, and the giant card does not respond from time to time, but many people recommend it. I don't know what's good. Maybe it's my posture. I recommend NetEase mumu that I tested personally:

After that, start to install the APP to be tested into the simulator. The work on this side of the simulator is done.

Next comes the protagonist of this scene, as follows:

Briefly describe this artifact, some developers of our daily software have developed the function of setting the agent, such as browser, postman and so on, it is very convenient to set the agent directly in the software, but some software does not have this function, we have to use this product if we want to hang up the agent for this kind of software.

The main interface is as follows:

There are 4 menus above, and the saved configuration is on the right. Click the first one to configure our proxy server (that is, the address where the packet grabbing tool listens):

I use burp, so I set it up as shown above. Next, set the rules. The interface is as follows:

To give a brief introduction, this configuration is a bit like the feeling of the routing table. First, give a name to the rule to be configured. After that, in Applications, you need to set up an agent for that software, and click the + sign below to select the software. At this time, he will prompt you whether to add the software associated with the selected software. I generally choose to join, which is easy. After that, the following two are the destination address and destination port, and the default Any is fine. The last step is the action, that is, how to handle the packet, select the proxy server that has just been configured.

A copy of all the rules I have configured is attached for your reference:

First: because burp is developed by java, the package of java program is directly connected (that is, the package caught by burp must be sent directly to the target server, not to mention the follow-up of the proxy chain)

The second rule: this is self-contained, which means a local direct connection, never mind.

Rule 3: if Application, choose our simulator. Both the target ip and the port Any,Action are proxies to the package grabbing tool we just set up.

It's all over now, start APP in the simulator, and then you can see the packets in burp.

The above is how to solve the problems of APP bag grabbing. The editor believes that there are some knowledge points that we may see or use in our daily work. I hope you can learn more from this article. For more details, please follow the industry information channel.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.