配置好代理，抓包
发现数据包被加密
POST /api/user/findPwd/sendMobileCode HTTP/1.1
Content-Type: application/json; charset=utf-8
User-Agent: Dalvik/2.1.0 (Linux; U; Android 10; Pixel 4 XL Build/QD1A.190821.011.C4)
Host: api.dodovip.com
Connection: Keep-Alive
Accept-Encoding: gzip
Content-Length: 147
{"Encrypt":"VcoXz6dO\/tjuNWaPqIrpEELMA00FHRtgFKeIQLPnSH3lVqERMQsIJhbsSuHhZ8redarTIiRnvxjN\n9Ur7agYTFuYX2uG0NzEON82mFkRb5l9YKoQ039ZpOPRNmmxx58do\n"}打开jadx反编译，通过关键字搜索定位找到两个函数
先进入第一个函数
跟进requestNetwork
编写hook代码hook sendMobileCode函数，传入两个手机号到函数中
Java.perform(function () {
console.log("xxx")
var jsonResult= Java.use("com.dodonew.online.ui.FindPasswordActivity");
jsonResult.sendMobileCode.implementation=function (a) {
console.log("jsonRequest.sendMobileCode is called");
console.log(a);
var b="1xxxxxxxxx9,1xxxxxxxxx1"
return this.sendMobileCode(b);
}
})使用frida hook
两个手机号码同时收到了一样的验证码
评论 (0)