Android https correct call Scheme (Anti-man-in-the-middle hijacking), androidhttps

Android https correct call Scheme (Anti-man-in-the-middle hijacking), androidhttps

The following content is original. You are welcome to reprint it.

From blog: http://www.cnblogs.com/joey-hua/p/4971380.html

1. hijack the https Interface

Although many android clients Use https, they can still be hijacked by third-party packet capture tools such as fiddler, because their code uses methods such as ALLOW_ALL_HOSTNAME_VERIFIER to allow any certificate. In this way, you can use the certificate provided by fiddler to disguise the server certificate to obtain intermediate communication data. Key steps:

The data is hijacked by the Industrial and Commercial Bank's Android app:

The red box shows the interface of ICBC. The blue text indicates that the data is captured and the data is not sent. It is my own account. The Green Box is my own server interface, and the gray text is not captured because of the processing. You must use a disguised certificate. Otherwise, you cannot directly capture the same interface.

2. Solution

 

【Document Download]