Giter VIP home page Giter VIP logo

miniprogram_cloudfunctions_tool's Introduction

微信小程序云函数抓包

在对微信小程序进行安全测试时，发现小程序采用了云函数开发方式作为中转，而采用云函数方式与服务器请求过程中采用微信mmtls传输通信，我们无法进行抓包修改数据。 当一个小程序云函数的请求数据经过腾讯自己构造mmtls加密传输后，若要想解密->修改->加密这个过程并不容易，甚至需要对APP深入逆向分析协议算法才能解密出明文,参考大佬之前阿里mpass抓包方法MpaasPentestTool在微信小程序云函数请求送入加密函数之前将明文数据hook住，再其上最修改，再送入加密函数，便可以达到修改数据包的目的。

分析函数

目前经过分析 在macos 小程序中-[WAJSEventHandler_operateWXDatarequestDataWithAppID:data:]为云函数发起请求前明文数据且可修改 -[WAJSEventHandler_operateWXData endWithResult:]为云函数返回后解密数据

启动方式

python miniprogram_cloudfunctions_request.py -t mac -p 11539
python miniprogram_cloudfunctions_request.py -t ios

截图验证

TODO

  • 1.安卓微信 云函数请求 抓包
  • 2.windows 云函数请求 抓包

参考资料

https://github.com/cnmsec/MpaasPentestTool

miniprogram_cloudfunctions_tool's People

Stargazers

avatar Coande avatar avatar 7 avatar 4Ark avatar avatar 小龙 avatar Clifford Kelter avatar avatar Anrik avatar 晏子诛士 avatar tanran avatar xjohjrdy avatar avatar soda avatar 风筝 avatar Longix Guo avatar avatar S3art、SL avatar maxowner avatar avatar Tea0 avatar avatar yougar0x00 avatar

Watchers

Tea0 avatar

Forkers

yougar0 j0o1ey wgetnz onegithuber wengle520 anrikgwp

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.