android - API 请求被 burp 套件拦截

Question

我正在开发具有 的应用程序SSL pinning 未实现 安全点开放。
下面这个方法负责使用 SSL 代码调用 API。我已经浏览了android官方文档。代码几乎相似。

private SSLSocketFactory sf;

public String post(Context context,final String domain) {
    try {
        CertificateFactory cf = CertificateFactory.getInstance("X.509");

        InputStream caInput = null;

        if (domain.equals("abc-connect.bank.com")) {
            caInput = new BufferedInputStream(context.getResources().openRawResource(R.raw.live_certificate));
        } else {
            caInput = new BufferedInputStream(context.getResources().openRawResource(R.raw.uat_certificate));
        }

        Certificate ca = cf.generateCertificate(caInput);
        caInput.close();

        String keyStoreType = KeyStore.getDefaultType();
        KeyStore keyStore = KeyStore.getInstance(keyStoreType);
        keyStore.load(null, null);
        keyStore.setCertificateEntry("ca", ca);

        String tmfAlgorithm = TrustManagerFactory.getDefaultAlgorithm();
        TrustManagerFactory tmf = TrustManagerFactory.getInstance(tmfAlgorithm);
        tmf.init(keyStore);

        TrustManager[] trustManagers = tmf.getTrustManagers();
        final X509TrustManager origTrustmanager = (X509TrustManager)trustManagers[0];

        TrustManager[] wrappedTrustManagers = new TrustManager[]{
                new X509TrustManager() {
                    public java.security.cert.X509Certificate[] getAcceptedIssuers() {
                        return origTrustmanager.getAcceptedIssuers();
                    }

                    public void checkClientTrusted(X509Certificate[] certs, String authType) {
                        try {
                            origTrustmanager.checkClientTrusted(certs, authType);
                        } catch (CertificateException e) {
                            Log.e("CertificateException 1 ", ""+e.getMessage());
                        }
                    }

                    public void checkServerTrusted(X509Certificate[] certs, String authType) {
                        try {
                            origTrustmanager.checkServerTrusted(certs, authType);
                        } catch (CertificateException e) {
                            Log.e("CertificateException 2 ", ""+e.getMessage());
                        }
                    }
                }
        };

        SSLContext sslContext = SSLContext.getInstance("TLS");
        sslContext.init(null, wrappedTrustManagers, null);

        sf = sslContext.getSocketFactory();

        HttpsURLConnection.setDefaultSSLSocketFactory(sf);

        URL url1 = new URL(this.url);
        HttpsURLConnection urlConnection = (HttpsURLConnection) url1.openConnection();

        urlConnection.setSSLSocketFactory(sf);

        int timeoutConnection = 20000;
        int timeoutSocket = 20000;

        urlConnection.setConnectTimeout(timeoutConnection);
        urlConnection.setReadTimeout(timeoutSocket);

        urlConnection.setRequestMethod("POST");
        urlConnection.setDoInput(true);
        urlConnection.setDoOutput(true);

        OutputStream os = urlConnection.getOutputStream();
        //below code removed.

        }
    } catch (Exception e) {
        response = "Error " + e;
    }
    return response;
}

我正在测试这段代码，我的 API 请求被 burp 套件捕获。下面是捕获请求的图像。

以下是来自built.gradle 文件的应用程序的最低和目标 SDK。

minSdkVersion 19
targetSdkVersion 21

有人可以告诉我为什么我的请求在 burp 套件中被捕获。

Answer 1

如果您正在拦截 URL，则无法隐藏 URL，例如“Wi-Fi”，但您可以通过使用 token 来保护您的数据，除了使用 ssl，我们还可以使用哈希生成，并且永远不会发送您的 header 中的珍贵 cargo 始终使用 RequestBody 发送您的数据(如果您有 SSL)。正如这里所解释的
secure communication.
希望这能解决你的答案。