CrackerCat / cookiecutter-frida

Cookiecutter template for hooking traffic encrytion by frida

Overview

This is a cookiecutter template for bypassing the traffic encryption in Android app. Please read this article first.

Install

> cookiecutter https://github.com/PadishahIII/cookiecutter-frida.git
  [1/9] directory_name (sample_project): frida
  [2/9] package_name (com.certain.package): com.xxxbank
  [3/9] app_name (AppName): 某某银行
  [4/9] local_ip (192.168.43.246): 
  [5/9] mitm_http_port (8082):
  [6/9] mitm_frida_port (27081):
  [7/9] frida_ip (127.0.0.1): 192.168.43.230
  [8/9] frida_port (3333):
  [9/9] rpc_server_port (8989):

Launch

Start echoServer

python echoServer.py

Start mitmproxy

mitmproxy -s mitmproxy_script/mitm.py --listen-host 0.0.0.0 -p {{ cookiecutter.mitm_frida_port }} --mode upstream:http://127.0.0.1:27080 -k

Optional:

mitmproxy -s mitmproxy_script/mitm_http.py --listen-host 0.0.0.0 -p {{ cookiecutter.mitm_http_port }} --mode upstream:http://127.0.0.1:8081 -k

Start burpTracer, inject js

python burpTracer.py -s hook_script/hook.js -r {{ cookiecutter.frida_ip }}:{{ cookiecutter.frida_port }} -n {{ cookiecutter.app_name }}

or start rpc server:

python burpTracer.py -s hook_script/hook.js -r {{ cookiecutter.frida_ip }}:{{ cookiecutter.frida_port }} -n {{ cookiecutter.app_name }} --rpc hook_script/encrypt_rpc.js -a hook_script/proxy.js

Start RPC server

python rpc_server.py hook_script/encrypt_rpc.js