手机抓包-fiddler

如果app走的是http协议，不用root，只需要通过fiddler做代理，就可以抓到所有请求。

1. fiddler+手机wifi设置

安装fiddler，勾中 Fiddler Options -> https -> Decrypt Https traffic 和 Connections -> Allow remote computers to connect 。重启之后，fiddler就在默认端口8888开始监听了。

手机上的wifi设置里，选择 手动 代理，主机名为PC的IP地址比如 192.168.0.108， 端口为8888。确认后，手机browser里访问http://192.168.0.108:8888，点击"FiddlerRoot certificate"安装证书。Android会提示先设置锁屏码 或 PIN码之类的，按提示做就行。

2. 抓包+分析

打开你要分析的app，点击按钮（例如：登录、同步等），如果背后走的是http/https，就能在fiddler里抓到request/response。比如某健康app的同步请求：

POST http://**health.com/japi/actionLst/uploadSportData HTTP/1.1
Content-Length: 2869
Content-Type: multipart/form-data; boundary=hZDrprkxC2osrCEx4XMWP2zehAAgxjpOgkbHUII
Host: **health.com
Connection: Keep-Alive
Expect: 100-continue
Cookie: PHPSESSID=dqb5h9nomu2fuuonnrleip6h71
Cookie2: $Version=1

--hZDrprkxC2osrCEx4XMWP2zehAAgxjpOgkbHUII
Content-Disposition: form-data; name="member_id"
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A1001
...

--hZDrprkxC2osrCEx4XMWP2zehAAgxjpOgkbHUII
Content-Disposition: form-data; name="distance"
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

0.08869565
--hZDrprkxC2osrCEx4XMWP2zehAAgxjpOgkbHUII
Content-Disposition: form-data; name="seconds"
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

73
--hZDrprkxC2osrCEx4XMWP2zehAAgxjpOgkbHUII
Content-Disposition: form-data; name="calorie"
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

5
--hZDrprkxC2osrCEx4XMWP2zehAAgxjpOgkbHUII
Content-Disposition: form-data; name="step"
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

120
--hZDrprkxC2osrCEx4XMWP2zehAAgxjpOgkbHUII
Content-Disposition: form-data; name="action_sign"
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

62ccc5709f192da3d4a8b68499e0bd68
--hZDrprkxC2osrCEx4XMWP2zehAAgxjpOgkbHUII--

能看到，请求是http明文的，包括用户id、距离、秒数、卡路里、步数等基本信息，只有一个action_sign对数据做了签名，这是比较危险的。回复的结果如下：

HTTP/1.1 200 OK
Server: nginx
Date: Sun, 10 Apr 2016 06:24:44 GMT
Content-Type: application/json;charset=UTF-8
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: POST, GET, OPTIONS, DELETE
Access-Control-Max-Age: 3600
Access-Control-Allow-Headers: x-requested-with
Content-Length: 26

{"status":"OK","result":8}

只要构造合适的boundary+actionSign，就能模拟请求伪造数据了。后面找时间再尝试一下tcpdump和WireShark，毕竟能抓所有协议，更强大一些。