手机抓包-fiddler

如果app走的是http协议，不用root，只需要通过fiddler做代理，就可以抓到所有请求。

1. fiddler+手机wifi设置

安装fiddler，勾中 Fiddler Options -> https -> Decrypt Https traffic 和 Connections -> Allow remote computers to connect 。重启之后，fiddler就在默认端口8888开始监听了。

手机上的wifi设置里，选择 手动 代理，主机名为PC的IP地址比如 192.168.0.108，端口为8888。确认后，手机browser里访问http://192.168.0.108:8888，点击"FiddlerRoot certificate"安装证书。Android会提示先设置锁屏码或 PIN码之类的，按提示做就行。

2. 抓包+分析

打开你要分析的app，点击按钮（例如：登录、同步等），如果背后走的是http/https，就能在fiddler里抓到request/response。比如某健康app的同步请求：

POST http://**health.com/japi/actionLst/uploadSportData HTTP/1.1

Content-Length: 2869

Content-Type: multipart/form-data; boundary=hZDrprkxC2osrCEx4XMWP2zehAAgxjpOgkbHUII

Host: **health.com

Connection: Keep-Alive

Expect: 100-continue

Cookie: PHPSESSID=dqb5h9nomu2fuuonnrleip6h71

Cookie2: $Version=1

--hZDrprkxC2osrCEx4XMWP2zehAAgxjpOgkbHUII

Content-Disposition: form-data; name="member_id"

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit

A1001

...

--hZDrprkxC2osrCEx4XMWP2zehAAgxjpOgkbHUII

Content-Disposition: form-data; name="distance"

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit

0.08869565

--hZDrprkxC2osrCEx4XMWP2zehAAgxjpOgkbHUII

Content-Disposition: form-data; name="seconds"

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit

73

--hZDrprkxC2osrCEx4XMWP2zehAAgxjpOgkbHUII

Content-Disposition: form-data; name="calorie"

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit

5

--hZDrprkxC2osrCEx4XMWP2zehAAgxjpOgkbHUII

Content-Disposition: form-data; name="step"

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit

120

--hZDrprkxC2osrCEx4XMWP2zehAAgxjpOgkbHUII

Content-Disposition: form-data; name="action_sign"

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit

62ccc5709f192da3d4a8b68499e0bd68

--hZDrprkxC2osrCEx4XMWP2zehAAgxjpOgkbHUII--

能看到，请求是http明文的，包括用户id、距离、秒数、卡路里、步数等基本信息，只有一个action_sign对数据做了签名，这是比较危险的。回复的结果如下：

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 10 Apr 2016 06:24:44 GMT

Content-Type: application/json;charset=UTF-8

Connection: keep-alive

Access-Control-Allow-Origin: *

Access-Control-Allow-Methods: POST, GET, OPTIONS, DELETE

Access-Control-Max-Age: 3600

Access-Control-Allow-Headers: x-requested-with

Content-Length: 26

{"status":"OK","result":8}

只要构造合适的boundary+actionSign，就能模拟请求伪造数据了。后面找时间再尝试一下tcpdump和WireShark，毕竟能抓所有协议，更强大一些。