【经验分享】使用Frida脚本强制给okhttp3.OkHttpClient设置代理。
背景：某些应用使用Proxy.NO_PROXY跳过系统代理设置（例如附图），导致代理模式无法抓到HTTPS流量。

脚本如下：
Java.perform(function(){
// OkHttpClient强制设置代理
var OkHttpClient = Java.use("okhttp3.OkHttpClient");
var OkHttpBuilder = Java.use("okhttp3.OkHttpClient$Builder");
var Proxy = Java.use("java.net.Proxy");
var ProxyType = Java.use("java.net.Proxy$Type");
var InetSocketAddress = Java.use("java.net.InetSocketAddress");
// 要设置的代理
var proxy = Proxy.$new(ProxyType.SOCKS.value, InetSocketAddress.createUnresolved("IP", int_port));

OkHttpClient.newBuilder.overload().implementation = function() {
return OkHttpBuilder.$new();
}
OkHttpBuilder.build.overload().implementation = function() {
console.log('[+] Installing proxy');
this.proxy(proxy);
return this.build();
}
OkHttpBuilder.proxy.overload("java.net.Proxy").implementation = function(input_proxy) {
console.log('[+] Changing proxy');
return this.proxy(proxy);
}
});

function lookup_okhttpclient(){
// 查看内存中的okhttp3.OkHttpClient实例的代理
Java.perform(function(){
Java.choose('okhttp3.OkHttpClient',
{
onMatch: function (instance){
console.log('Found instance: ' + instance + ', Current proxy: ' + instance.proxy());
},
onComplete: function ()
{
}
});
});
}

另外，通过调用lookup_okhttpclient()可以动态查看内存中okhttp3.OkHttpClient实例的代理设置情况。

• 

去微博查看或评论