先自我介绍一下,小编浙江大学毕业,去过华为、字节跳动等大厂,目前阿里P7
深知大多数程序员,想要提升技能,往往是自己摸索成长,但自己不成体系的自学效果低效又漫长,而且极易碰到天花板技术停滞不前!
因此收集整理了一份《2024年最新网络安全全套学习资料》,初衷也很简单,就是希望能够帮助到想自学提升又不知道该从何学起的朋友。
既有适合小白学习的零基础资料,也有适合3年以上经验的小伙伴深入学习提升的进阶课程,涵盖了95%以上网络安全知识点,真正体系化!
由于文件比较多,这里只是将部分目录截图出来,全套包含大厂面经、学习笔记、源码讲义、实战项目、大纲路线、讲解视频,并且后续会持续更新
如果你需要这些资料,可以添加V获取:vip204888 (备注网络安全)
正文
<domain-config cleartextTrafficPermitted="true">
<domain includeSubdomains="true">ttt.com</domain>
<!--利用xml校验证书公钥的hash值-->
<pin-set expiration="2099-01-01"
tools:ignore="MissingBackupPin">
<pin digest="SHA-256">7VMdvZE3PGbxb0Pgf1PlCp+MI8KZ2ZC5psM8TIylNDA=</pin>
</pin-set>
<!--利用xml校验证书的公钥文件-->
<trust-anchors>
<certificates src="@raw/ttt"/>
</trust-anchors>
</domain-config>
复制代码
这两种校验机制出现一种即可,从代码中可以看出,ttt.com就是安卓自己要校验绑定的域名。
如果只是在这个文件进行校验,有两种解决方案:一是直接将文件中校验的部分或注释掉,再重新打包和签名即可,但是这过程又有些麻烦,并不是上上策,如果遇到了不能重打包的apk就尴尬了。。。二是最常用的也是最好用的frida来hook关键函数进行绕过,后面会讲解。当然有些人会直接在真机或者模拟器上安装xposed模块,但是我个人觉得每次使用都要软重启,可能还会造成卡机,所以感觉还是使用frida最方便。
#### 在代码中检验的两种方法
1.利用代码校验证书的公钥hash
String hostname = “www.ttt.com”;
CertificatePinner certificatePinner = new CertificatePinner.Builder()
.add(hostname, “sha256/7VMdvZE3PGbxb0Pgf1PlCp+MI8KZ2ZC5psM8TIylNDA=”)
.build();
OkHttpClient client = new OkHttpClient.Builder()
.certificatePinner(certificatePinner)
.hostnameVerifier(new HostnameVerifier() {
@Override
public boolean verify(String hostname, SSLSession session) {
return true;
}
}).build();
复制代码
2.利用代码校验证书的公钥证书文件
// 获取证书输入流
InputStream openRawResource = getApplicationContext().getResources().openRawResource(R.raw.ttt);
Certificate ca = CertificateFactory.getInstance(“X.509”).generateCertificate(openRawResource);
// 创建 Keystore 包含我们的证书
KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
keyStore.load(null, null);
keyStore.setCertificateEntry(“ca”, ca);
// 创建一个 TrustManager 仅把 Keystore 中的证书 作为信任的锚点
TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm()); // 建议不要使用自己实现的X509TrustManager,而是使用默认的X509TrustManager
trustManagerFactory.init(keyStore);
// 用 TrustManager 初始化一个 SSLContext
sslContext = SSLContext.getInstance(“TLS”); //定义:public static SSLContext sslContext = null;
sslContext.init(null, trustManagerFactory.getTrustManagers(), new SecureRandom());
OkHttpClient client = new OkHttpClient.Builder()
.sslSocketFactory(sslContext.getSocketFactory(),
(X509TrustManager) trustManagerFactory.getTrustManagers()[0] )
.hostnameVerifier(new HostnameVerifier() {
@Override
public boolean verify(String hostname, SSLSession session) {
return true;
}
}).build();
复制代码
通过frida进行hook,这种绕过的脚本也很多,比较熟悉的有JustTrustMe和`DroidSSLUnpinning`,他们的底层原理都是一样的,通过hook关键的验证函数,进行逻辑绕过。
frida的安装过程就不详细讲解了,网上很多教程。这里我使用的是`frida 12.8.0 + frida-tools=5.3.0`
这里我使用的hook.js的脚本如下:
/* Android ssl certificate pinning bypass script for various methods
by Maurizio Siddu modify by Ch3nYe
Run with:
frida -U -f [APP_ID] -l frida_multiple_unpinning.js --no-pause
*/
setTimeout(function() {
Java.perform(function () {
console.log(‘’);
console.log(‘‘);
console.log(’[#] Android Bypass for various Certificate Pinning methods [#]‘);
console.log(’’);
var X509TrustManager = Java.use(‘javax.net.ssl.X509TrustManager’);
var SSLContext = Java.use(‘javax.net.ssl.SSLContext’);
// TrustManager (Android < 7) //
var TrustManager = Java.registerClass({
// Implement a custom TrustManager
name: ‘dev.asd.test.TrustManager’,
implements: [X509TrustManager],
methods: {
checkClientTrusted: function (chain, authType) {},
checkServerTrusted: function (chain, authType) {},
getAcceptedIssuers: function () {return []; }
}
});
// Prepare the TrustManager array to pass to SSLContext.init()
var TrustManagers = [TrustManager.$new()];
// Get a handle on the init() on the SSLContext class
var SSLContext_init = SSLContext.init.overload(
‘[Ljavax.net.ssl.KeyManager;’, ‘[Ljavax.net.ssl.TrustManager;’, ‘java.security.SecureRandom’);
try {
// Override the init method, specifying the custom TrustManager
SSLContext_init.implementation = function(keyManager, trustManager, secureRandom) {
console.log(‘[+] Bypassing Trustmanager (Android < 7) request’);
SSLContext_init.call(this, keyManager, TrustManagers, secureRandom);
};
} catch (err) {
console.log(‘[-] TrustManager (Android < 7) pinner not found’);
//console.log(err);
}
// OkHTTPv3 (quadruple bypass) //
/
try {
// Bypass OkHTTPv3 {1}
var okhttp3_Activity_1 = Java.use(‘okhttp3.CertificatePinner’);
okhttp3_Activity_1.check.overload(‘java.lang.String’, ‘java.util.List’).implementation = function (a, b) {
console.log(‘[+] Bypassing OkHTTPv3 {1}: ’ + a);
return true;
};
} catch (err) {
console.log(’[-] OkHTTPv3 {1} pinner not found’);
//console.log(err);
}
try {
// Bypass OkHTTPv3 {2}
// This method of CertificatePinner.check could be found in some old Android app
var okhttp3_Activity_2 = Java.use(‘okhttp3.CertificatePinner’);
okhttp3_Activity_2.check.overload(‘java.lang.String’, ‘java.security.cert.Certificate’).implementation = function (a, b) {
console.log(‘[+] Bypassing OkHTTPv3 {2}: ’ + a);
return true;
};
} catch (err) {
console.log(’[-] OkHTTPv3 {2} pinner not found’);
//console.log(err);
}
try {
// Bypass OkHTTPv3 {3}
var okhttp3_Activity_3 = Java.use(‘okhttp3.CertificatePinner’);
okhttp3_Activity_3.check.overload(‘java.lang.String’, ‘[Ljava.security.cert.Certificate;’).implementation = function (a, b) {
console.log(‘[+] Bypassing OkHTTPv3 {3}: ’ + a);
return true;
};
} catch(err) {
console.log(’[-] OkHTTPv3 {3} pinner not found’);
//console.log(err);
}
try {
// Bypass OkHTTPv3 {4}
var okhttp3_Activity_4 = Java.use(‘okhttp3.CertificatePinner’);
okhttp3_Activity_4[‘’].implementation = function (a, b) {
console.log(‘[+] Bypassing OkHTTPv3 {4}: ’ + a);
};
} catch(err) {
console.log(’[-] OkHTTPv3 {4} pinner not found’);
//console.log(err);
}
// Trustkit (triple bypass) //
//
try {
// Bypass Trustkit {1}
var trustkit_Activity_1 = Java.use(‘com.datatheorem.android.trustkit.pinning.OkHostnameVerifier’);
trustkit_Activity_1.verify.overload(‘java.lang.String’, ‘javax.net.ssl.SSLSession’).implementation = function (a, b) {
console.log(‘[+] Bypassing Trustkit {1}: ’ + a);
return true;
};
} catch (err) {
console.log(’[-] Trustkit {1} pinner not found’);
//console.log(err);
}
try {
// Bypass Trustkit {2}
var trustkit_Activity_2 = Java.use(‘com.datatheorem.android.trustkit.pinning.OkHostnameVerifier’);
trustkit_Activity_2.verify.overload(‘java.lang.String’, ‘java.security.cert.X509Certificate’).implementation = function (a, b) {
console.log(‘[+] Bypassing Trustkit {2}: ’ + a);
return true;
};
} catch (err) {
console.log(’[-] Trustkit {2} pinner not found’);
//console.log(err);
}
try {
// Bypass Trustkit {3}
var trustkit_PinningTrustManager = Java.use(‘com.datatheorem.android.trustkit.pinning.PinningTrustManager’);
trustkit_PinningTrustManager.checkServerTrusted.implementation = function () {
console.log(‘[+] Bypassing Trustkit {3}’);
};
} catch (err) {
console.log(‘[-] Trustkit {3} pinner not found’);
//console.log(err);
}
// TrustManagerImpl (Android > 7) //
try {
var TrustManagerImpl = Java.use(‘com.android.org.conscrypt.TrustManagerImpl’);
TrustManagerImpl.verifyChain.implementation = function (untrustedChain, trustAnchorChain, host, clientAuth, ocspData, tlsSctData) {
console.log(‘[+] Bypassing TrustManagerImpl (Android > 7): ’ + host);
return untrustedChain;
};
} catch (err) {
console.log(’[-] TrustManagerImpl (Android > 7) pinner not found’);
//console.log(err);
}
// Appcelerator Titanium //
///
try {
var appcelerator_PinningTrustManager = Java.use(‘appcelerator.https.PinningTrustManager’);
appcelerator_PinningTrustManager.checkServerTrusted.implementation = function () {
console.log(‘[+] Bypassing Appcelerator PinningTrustManager’);
};
} catch (err) {
console.log(‘[-] Appcelerator PinningTrustManager pinner not found’);
//console.log(err);
}
// OpenSSLSocketImpl Conscrypt //
/
try {
var OpenSSLSocketImpl = Java.use(‘com.android.org.conscrypt.OpenSSLSocketImpl’);
OpenSSLSocketImpl.verifyCertificateChain.implementation = function (certRefs, JavaObject, authMethod) {
console.log(‘[+] Bypassing OpenSSLSocketImpl Conscrypt’);
};
} catch (err) {
console.log(‘[-] OpenSSLSocketImpl Conscrypt pinner not found’);
//console.log(err);
}
// OpenSSLEngineSocketImpl Conscrypt //
///
try {
var OpenSSLEngineSocketImpl_Activity = Java.use(‘com.android.org.conscrypt.OpenSSLEngineSocketImpl’);
OpenSSLSocketImpl_Activity.verifyCertificateChain.overload(‘[Ljava.lang.Long;’, ‘java.lang.String’).implementation = function (a, b) {
console.log(‘[+] Bypassing OpenSSLEngineSocketImpl Conscrypt: ’ + b);
};
} catch (err) {
console.log(’[-] OpenSSLEngineSocketImpl Conscrypt pinner not found’);
//console.log(err);
}
// OpenSSLSocketImpl Apache Harmony //
//
try {
var OpenSSLSocketImpl_Harmony = Java.use(‘org.apache.harmony.xnet.provider.jsse.OpenSSLSocketImpl’);
OpenSSLSocketImpl_Harmony.verifyCertificateChain.implementation = function (asn1DerEncodedCertificateChain, authMethod) {
console.log(‘[+] Bypassing OpenSSLSocketImpl Apache Harmony’);
};
} catch (err) {
console.log(‘[-] OpenSSLSocketImpl Apache Harmony pinner not found’);
//console.log(err);
}
// PhoneGap sslCertificateChecker (https://github.com/EddyVerbruggen/SSLCertificateChecker-PhoneGap-Plugin) //
//
try {
var phonegap_Activity = Java.use(‘nl.xservices.plugins.sslCertificateChecker’);
phonegap_Activity.execute.overload(‘java.lang.String’, ‘org.json.JSONArray’, ‘org.apache.cordova.CallbackContext’).implementation = function (a, b, c) {
console.log(‘[+] Bypassing PhoneGap sslCertificateChecker: ’ + a);
return true;
};
} catch (err) {
console.log(’[-] PhoneGap sslCertificateChecker pinner not found’);
//console.log(err);
}
// IBM MobileFirst pinTrustedCertificatePublicKey (double bypass) //
try {
// Bypass IBM MobileFirst {1}
var WLClient_Activity_1 = Java.use(‘com.worklight.wlclient.api.WLClient’);
WLClient_Activity_1.getInstance().pinTrustedCertificatePublicKey.overload(‘java.lang.String’).implementation = function (cert) {
console.log(‘[+] Bypassing IBM MobileFirst pinTrustedCertificatePublicKey {1}: ’ + cert);
return;
};
} catch (err) {
console.log(’[-] IBM MobileFirst pinTrustedCertificatePublicKey {1} pinner not found’);
//console.log(err);
}
try {
// Bypass IBM MobileFirst {2}
var WLClient_Activity_2 = Java.use(‘com.worklight.wlclient.api.WLClient’);
WLClient_Activity_2.getInstance().pinTrustedCertificatePublicKey.overload(‘[Ljava.lang.String;’).implementation = function (cert) {
console.log(‘[+] Bypassing IBM MobileFirst pinTrustedCertificatePublicKey {2}: ’ + cert);
return;
};
} catch (err) {
console.log(’[-] IBM MobileFirst pinTrustedCertificatePublicKey {2} pinner not found’);
//console.log(err);
}
// IBM WorkLight (ancestor of MobileFirst) HostNameVerifierWithCertificatePinning (quadruple bypass) //
///
try {
// Bypass IBM WorkLight {1}
var worklight_Activity_1 = Java.use(‘com.worklight.wlclient.certificatepinning.HostNameVerifierWithCertificatePinning’);
worklight_Activity_1.verify.overload(‘java.lang.String’, ‘javax.net.ssl.SSLSocket’).implementation = function (a, b) {
console.log(‘[+] Bypassing IBM WorkLight HostNameVerifierWithCertificatePinning {1}: ’ + a);
return;
};
} catch (err) {
console.log(’[-] IBM WorkLight HostNameVerifierWithCertificatePinning {1} pinner not found’);
//console.log(err);
}
try {
// Bypass IBM WorkLight {2}
var worklight_Activity_2 = Java.use(‘com.worklight.wlclient.certificatepinning.HostNameVerifierWithCertificatePinning’);
worklight_Activity_2.verify.overload(‘java.lang.String’, ‘java.security.cert.X509Certificate’).implementation = function (a, b) {
console.log(‘[+] Bypassing IBM WorkLight HostNameVerifierWithCertificatePinning {2}: ’ + a);
return;
};
} catch (err) {
console.log(’[-] IBM WorkLight HostNameVerifierWithCertificatePinning {2} pinner not found’);
//console.log(err);
}
try {
// Bypass IBM WorkLight {3}
var worklight_Activity_3 = Java.use(‘com.worklight.wlclient.certificatepinning.HostNameVerifierWithCertificatePinning’);
worklight_Activity_3.verify.overload(‘java.lang.String’, ‘[Ljava.lang.String;’, ‘[Ljava.lang.String;’).implementation = function (a, b) {
console.log(‘[+] Bypassing IBM WorkLight HostNameVerifierWithCertificatePinning {3}: ’ + a);
return;
};
} catch (err) {
console.log(’[-] IBM WorkLight HostNameVerifierWithCertificatePinning {3} pinner not found’);
//console.log(err);
}
try {
// Bypass IBM WorkLight {4}
var worklight_Activity_4 = Java.use(‘com.worklight.wlclient.certificatepinning.HostNameVerifierWithCertificatePinning’);
worklight_Activity_4.verify.overload(‘java.lang.String’, ‘javax.net.ssl.SSLSession’).implementation = function (a, b) {
console.log(‘[+] Bypassing IBM WorkLight HostNameVerifierWithCertificatePinning {4}: ’ + a);
return true;
};
} catch (err) {
console.log(’[-] IBM WorkLight HostNameVerifierWithCertificatePinning {4} pinner not found’);
//console.log(err);
}
// Conscrypt CertPinManager //
//
try {
var conscrypt_CertPinManager_Activity = Java.use(‘com.android.org.conscrypt.CertPinManager’);
conscrypt_CertPinManager_Activity.isChainValid.overload(‘java.lang.String’, ‘java.util.List’).implementation = function (a, b) {
console.log(‘[+] Bypassing Conscrypt CertPinManager: ’ + a);
return true;
};
} catch (err) {
console.log(’[-] Conscrypt CertPinManager pinner not found’);
//console.log(err);
}
// CWAC-Netsecurity (unofficial back-port pinner for Android<4.2) CertPinManager //
///
try {
var cwac_CertPinManager_Activity = Java.use(‘com.commonsware.cwac.netsecurity.conscrypt.CertPinManager’);
cwac_CertPinManager_Activity.isChainValid.overload(‘java.lang.String’, ‘java.util.List’).implementation = function (a, b) {
console.log(‘[+] Bypassing CWAC-Netsecurity CertPinManager: ’ + a);
return true;
};
} catch (err) {
console.log(’[-] CWAC-Netsecurity CertPinManager pinner not found’);
//console.log(err);
}
// Worklight Androidgap WLCertificatePinningPlugin //
/
try {
var androidgap_WLCertificatePinningPlugin_Activity = Java.use(‘com.worklight.androidgap.plugin.WLCertificatePinningPlugin’);
androidgap_WLCertificatePinningPlugin_Activity.execute.overload(‘java.lang.String’, ‘org.json.JSONArray’, ‘org.apache.cordova.CallbackContext’).implementation = function (a, b, c) {
console.log(‘[+] Bypassing Worklight Androidgap WLCertificatePinningPlugin: ’ + a);
return true;
};
} catch (err) {
console.log(’[-] Worklight Androidgap WLCertificatePinningPlugin pinner not found’);
//console.log(err);
}
// Netty FingerprintTrustManagerFactory //
//
try {
var netty_FingerprintTrustManagerFactory = Java.use(‘io.netty.handler.ssl.util.FingerprintTrustManagerFactory’);
//NOTE: sometimes this below implementation could be useful
//var netty_FingerprintTrustManagerFactory = Java.use(‘org.jboss.netty.handler.ssl.util.FingerprintTrustManagerFactory’);
netty_FingerprintTrustManagerFactory.checkTrusted.implementation = function (type, chain) {
console.log(‘[+] Bypassing Netty FingerprintTrustManagerFactory’);
};
} catch (err) {
console.log(‘[-] Netty FingerprintTrustManagerFactory pinner not found’);
//console.log(err);
}
// Squareup CertificatePinner [OkHTTP<v3] (double bypass) //
try {
// Bypass Squareup CertificatePinner {1}
var Squareup_CertificatePinner_Activity_1 = Java.use(‘com.squareup.okhttp.CertificatePinner’);
Squareup_CertificatePinner_Activity_1.check.overload(‘java.lang.String’, ‘java.security.cert.Certificate’).implementation = function (a, b) {
console.log(‘[+] Bypassing Squareup CertificatePinner {1}: ’ + a);
return;
};
} catch (err) {
console.log(’[-] Squareup CertificatePinner {1} pinner not found’);
//console.log(err);
}
try {
// Bypass Squareup CertificatePinner {2}
var Squareup_CertificatePinner_Activity_2 = Java.use(‘com.squareup.okhttp.CertificatePinner’);
Squareup_CertificatePinner_Activity_2.check.overload(‘java.lang.String’, ‘java.util.List’).implementation = function (a, b) {
console.log(‘[+] Bypassing Squareup CertificatePinner {2}: ’ + a);
return;
};
} catch (err) {
console.log(’[-] Squareup CertificatePinner {2} pinner not found’);
//console.log(err);
}
// Squareup OkHostnameVerifier [OkHTTP v3] (double bypass) //
/
try {
// Bypass Squareup OkHostnameVerifier {1}
var Squareup_OkHostnameVerifier_Activity_1 = Java.use(‘com.squareup.okhttp.internal.tls.OkHostnameVerifier’);
Squareup_OkHostnameVerifier_Activity_1.verify.overload(‘java.lang.String’, ‘java.security.cert.X509Certificate’).implementation = function (a, b) {
console.log(‘[+] Bypassing Squareup OkHostnameVerifier {1}: ’ + a);
return true;
};
} catch (err) {
console.log(’[-] Squareup OkHostnameVerifier pinner not found’);
//console.log(err);
}
try {
// Bypass Squareup OkHostnameVerifier {2}
var Squareup_OkHostnameVerifier_Activity_2 = Java.use(‘com.squareup.okhttp.internal.tls.OkHostnameVerifier’);
Squareup_OkHostnameVerifier_Activity_2.verify.overload(‘java.lang.String’, ‘javax.net.ssl.SSLSession’).implementation = function (a, b) {
console.log(‘[+] Bypassing Squareup OkHostnameVerifier {2}: ’ + a);
return true;
};
} catch (err) {
console.log(’[-] Squareup OkHostnameVerifier pinner not found’);
//console.log(err);
}
// Android WebViewClient (double bypass) //
///
try {
// Bypass WebViewClient {1} (deprecated from Android 6)
var AndroidWebViewClient_Activity_1 = Java.use(‘android.webkit.WebViewClient’);
AndroidWebViewClient_Activity_1.onReceivedSslError.overload(‘android.webkit.WebView’, ‘android.webkit.SslErrorHandler’, ‘android.net.http.SslError’).implementation = function (obj1, obj2, obj3) {
console.log(‘[+] Bypassing Android WebViewClient {1}’);
};
} catch (err) {
console.log(‘[-] Android WebViewClient {1} pinner not found’);
//console.log(err)
}
try {
// Bypass WebViewClient {2}
var AndroidWebViewClient_Activity_2 = Java.use(‘android.webkit.WebViewClient’);
AndroidWebViewClient_Activity_2.onReceivedSslError.overload(‘android.webkit.WebView’, ‘android.webkit.WebResourceRequest’, ‘android.webkit.WebResourceError’).implementation = function (obj1, obj2, obj3) {
console.log(‘[+] Bypassing Android WebViewClient {2}’);
};
} catch (err) {
console.log(‘[-] Android WebViewClient {2} pinner not found’);
//console.log(err)
}
// Apache Cordova WebViewClient //
//
try {
var CordovaWebViewClient_Activity = Java.use(‘org.apache.cordova.CordovaWebViewClient’);
CordovaWebViewClient_Activity.onReceivedSslError.overload(‘android.webkit.WebView’, ‘android.webkit.SslErrorHandler’, ‘android.net.http.SslError’).implementation = function (obj1, obj2, obj3) {
console.log(‘[+] Bypassing Apache Cordova WebViewClient’);
obj3.proceed();
};
} catch (err) {
console.log(‘[-] Apache Cordova WebViewClient pinner not found’);
//console.log(err);
}
// Boye AbstractVerifier //
///
try {
var boye_AbstractVerifier = Java.use(‘ch.boye.httpclientandroidlib.conn.ssl.AbstractVerifier’);
boye_AbstractVerifier.verify.implementation = function (host, ssl) {
console.log(‘[+] Bypassing Boye AbstractVerifier: ’ + host);
};
} catch (err) {
console.log(’[-] Boye AbstractVerifier pinner not found’);
//console.log(err);
}
});
}, 0);
复制代码
启动frida进行hook指定APP的包名
frida -U -f com.example.safehttps -l hook.js --no-pause
复制代码
![image.png](https://img-blog.csdnimg.cn/img_convert/7d1a316e9a051a8d1fb5b92c449d1bb0.webp?x-oss-process=image/format,png)
可以看到开启burp抓包成功。
### 5.开启双向校验
双向校验顾名思义也就是服务器也要对客户端进行证书校验,在刚才客户端校验服务端的基础上添加一直被校验的逻辑在里面。
首先ttt.com所在的nginx服务器要开启双向认证 ![image.png](https://img-blog.csdnimg.cn/img_convert/f07c15486e0b4b176fda65eb56eb4832.webp?x-oss-process=image/format,png)
开启客户端的校验后,在浏览器进行访问,会发现返回400,没有被请求的SSL证书发送,是因为浏览器正常请求不会携带证书信息去请求ttt.com ![image.png](https://img-blog.csdnimg.cn/img_convert/10255f0bf793b79dda629156743fe904.webp?x-oss-process=image/format,png)
那么如何携带客户端的证书,就要利用burp来操作,将ttt.com的证书添加到TLS客户证书 ![image.png](https://img-blog.csdnimg.cn/img_convert/733c600c418a383fde47b42d246b2749.webp?x-oss-process=image/format,png)
这时再访问 ![image.png](https://img-blog.csdnimg.cn/img_convert/42e044b1f66c4ec331f5d7cc91fae961.webp?x-oss-process=image/format,png)
在APP中进行绑定客户端的证书文件,一般是p12格式文件,会放在assets目录下或者raw目录下,client.p12会有一个密钥内置在代码中,需要找到才能添加进burp中。 ![image.png](https://img-blog.csdnimg.cn/img_convert/569a6427484aa91bd6f4d70876e8f284.webp?x-oss-process=image/format,png)
这个在反编译后的目录下也能找到,通常在assets或者res/raw目录下查找,但是再导入burp这一步是需要证书密码的,比如上图能明显看到密码是123456,但是找不到证书密码怎么办,可以看一下目录下是否存在lib文件夹,如果存在的话极大可能是将密码写进so层了,这就需要你会IDA反汇编获取证书密钥了,这部分在此不详细阐述,感兴趣的朋友可以先去研究一下。 ![image.png](https://img-blog.csdnimg.cn/img_convert/e52377fdc623630c450b501454dafae3.webp?x-oss-process=image/format,png)
#### APP双向校验验证
服务器校验客户端的证书ClientSSLSocketFactory,服务端将客户端的证书进行绑定。
TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
trustManagerFactory.init((KeyStore) null);
TrustManager[] trustManagers = trustManagerFactory.getTrustManagers();
if (trustManagers.length != 1 || !(trustManagers[0] instanceof X509TrustManager)) {
throw new IllegalStateException(“Unexpected default trust managers:” + Arrays.toString(trustManagers));
}
trustManager = (X509TrustManager) trustManagers[0];
OkHttpClient client = new OkHttpClient.Builder()
.sslSocketFactory(Objects.requireNonNull(ClientSSLSocketFactory.getSocketFactory(getApplicationContext())), Objects.requireNonNull(trustManager))
.hostnameVerifier(new HostnameVerifier() {
@Override
public boolean verify(String hostname, SSLSession session) {
//强行返回true 即验证成功
return true;
}
}).build();
复制代码
### 如何自学黑客&网络安全
#### 黑客零基础入门学习路线&规划
**初级黑客**
**1、网络安全理论知识(2天)**
①了解行业相关背景,前景,确定发展方向。
②学习网络安全相关法律法规。
③网络安全运营的概念。
④等保简介、等保规定、流程和规范。(非常重要)
**2、渗透测试基础(一周)**
①渗透测试的流程、分类、标准
②信息收集技术:主动/被动信息搜集、Nmap工具、Google Hacking
③漏洞扫描、漏洞利用、原理,利用方法、工具(MSF)、绕过IDS和反病毒侦察
④主机攻防演练:MS17-010、MS08-067、MS10-046、MS12-20等
**3、操作系统基础(一周)**
①Windows系统常见功能和命令
②Kali Linux系统常见功能和命令
③操作系统安全(系统入侵排查/系统加固基础)
**4、计算机网络基础(一周)**
①计算机网络基础、协议和架构
②网络通信原理、OSI模型、数据转发流程
③常见协议解析(HTTP、TCP/IP、ARP等)
④网络攻击技术与网络安全防御技术
⑤Web漏洞原理与防御:主动/被动攻击、DDOS攻击、CVE漏洞复现
**5、数据库基础操作(2天)**
①数据库基础
②SQL语言基础
③数据库安全加固
**6、Web渗透(1周)**
①HTML、CSS和JavaScript简介
②OWASP Top10
③Web漏洞扫描工具
④Web渗透工具:Nmap、BurpSuite、SQLMap、其他(菜刀、漏扫等)
恭喜你,如果学到这里,你基本可以从事一份网络安全相关的工作,比如渗透测试、Web 渗透、安全服务、安全分析等岗位;如果等保模块学的好,还可以从事等保工程师。薪资区间6k-15k
到此为止,大概1个月的时间。你已经成为了一名“脚本小子”。那么你还想往下探索吗?
如果你想要入坑黑客&网络安全,笔者给大家准备了一份:282G全网最全的网络安全资料包评论区留言即可领取!
**7、脚本编程(初级/中级/高级)**
在网络安全领域。是否具备编程能力是“脚本小子”和真正黑客的本质区别。在实际的渗透测试过程中,面对复杂多变的网络环境,当常用工具不能满足实际需求的时候,往往需要对现有工具进行扩展,或者编写符合我们要求的工具、自动化脚本,这个时候就需要具备一定的编程能力。在分秒必争的CTF竞赛中,想要高效地使用自制的脚本工具来实现各种目的,更是需要拥有编程能力.
如果你零基础入门,笔者建议选择脚本语言Python/PHP/Go/Java中的一种,对常用库进行编程学习;搭建开发环境和选择IDE,PHP环境推荐Wamp和XAMPP, IDE强烈推荐Sublime;·Python编程学习,学习内容包含:语法、正则、文件、 网络、多线程等常用库,推荐《Python核心编程》,不要看完;·用Python编写漏洞的exp,然后写一个简单的网络爬虫;·PHP基本语法学习并书写一个简单的博客系统;熟悉MVC架构,并试着学习一个PHP框架或者Python框架 (可选);·了解Bootstrap的布局或者CSS。
**8、超级黑客**
这部分内容对零基础的同学来说还比较遥远,就不展开细说了,附上学习路线。
![img](https://img-blog.csdnimg.cn/img_convert/3fd39c2ba8ec22649979f245f4221608.webp?x-oss-process=image/format,png)
#### 网络安全工程师企业级学习路线
![img](https://img-blog.csdnimg.cn/img_convert/931ac5ac21a22d230645ccf767358997.webp?x-oss-process=image/format,png)
如图片过大被平台压缩导致看不清的话,评论区点赞和评论区留言获取吧。我都会回复的
视频配套资料&国内外网安书籍、文档&工具
当然除了有配套的视频,同时也为大家整理了各种文档和书籍资料&工具,并且已经帮大家分好类了。
![img](https://img-blog.csdnimg.cn/img_convert/153b2778a3fe5198265bed9635d63469.webp?x-oss-process=image/format,png)
一些笔者自己买的、其他平台白嫖不到的视频教程。
![img](https://img-blog.csdnimg.cn/img_convert/32eb4b22aa740233c5198d3c161b37e8.webp?x-oss-process=image/format,png)
**网上学习资料一大堆,但如果学到的知识不成体系,遇到问题时只是浅尝辄止,不再深入研究,那么很难做到真正的技术提升。**
**需要这份系统化的资料的朋友,可以添加V获取:vip204888 (备注网络安全)**
![img](https://img-blog.csdnimg.cn/img_convert/8724623010d4f7ab9f186161d4f11a9d.png)
**一个人可以走的很快,但一群人才能走的更远!不论你是正从事IT行业的老鸟或是对IT行业感兴趣的新人,都欢迎加入我们的的圈子(技术交流、学习资源、职场吐槽、大厂内推、面试辅导),让我们一起学习成长!**
45ccf767358997.webp?x-oss-process=image/format,png)
如图片过大被平台压缩导致看不清的话,评论区点赞和评论区留言获取吧。我都会回复的
视频配套资料&国内外网安书籍、文档&工具
当然除了有配套的视频,同时也为大家整理了各种文档和书籍资料&工具,并且已经帮大家分好类了。
![img](https://img-blog.csdnimg.cn/img_convert/153b2778a3fe5198265bed9635d63469.webp?x-oss-process=image/format,png)
一些笔者自己买的、其他平台白嫖不到的视频教程。
![img](https://img-blog.csdnimg.cn/img_convert/32eb4b22aa740233c5198d3c161b37e8.webp?x-oss-process=image/format,png)
**网上学习资料一大堆,但如果学到的知识不成体系,遇到问题时只是浅尝辄止,不再深入研究,那么很难做到真正的技术提升。**
**需要这份系统化的资料的朋友,可以添加V获取:vip204888 (备注网络安全)**
[外链图片转存中...(img-CpNeX3Tc-1713586158461)]
**一个人可以走的很快,但一群人才能走的更远!不论你是正从事IT行业的老鸟或是对IT行业感兴趣的新人,都欢迎加入我们的的圈子(技术交流、学习资源、职场吐槽、大厂内推、面试辅导),让我们一起学习成长!**