92棋牌游戏下载

   4个月前 (11-20) 中国互联安全响应中心  固若金汤
文章评分 1 次,平均分 4.0

0x00 背景


ZUOWebCENGMIANDEANQUANCESHI,MIANBULEYAOZUOZHONGJIANRENDAILILAIJIEBAOFENXI。CHANGYONGDEGONGJUYOUBurpSuit,Fiddler,CharlesDENGDENG。GUANYUZHEIXIEGONGJUDEYONGFAWANGSHANGYIJINGYOUHENDUOJIESHAO,ZHEILIJIUBUZHUISHULE。RANERZAICESHIYIXIEANQUANXINGGAODEZHANDIANSHI,WANGWANGHUIYUDAOSSLTONGXINDEWENTI。ZHEILIDUIZHEIXIESHUZIZHENGSHUDEWENTIJINXINGYIGEXIAOJIE,HUANYINGPAIZHUANJIAOLIU。

0x01 数字证书


92棋牌游戏下载SHUZIZHENGSHUZHUYAOZAIHULIANWANGSHANGDEYONGYUSHENFENYANZHENGDEYONGTU。 ANQUANZHANDIANZAIHUODECA(Certificate Authority)RENZHENGHOU,HUODEYIGESHUZIZHENGSHU,YICILAIBIAOSHIQIHEFASHENFENDEZHENSHIXING。

92棋牌游戏下载SHUZIZHENGSHUDEGESHIZUNXUNX.509BIAOZHUN。(X.509SHIYOUGUOJIDIANXINLIANMENG(ITU-T)ZHIDINGDESHUZIZHENGSHUBIAOZHUN。TASHEDINGLEYIXILIEYANGEDECAFENJITIXILAIBANFASHUZIZHENGSHU。) SHUZIZHENGSHUZHUYAOFENWEIFUWUQIZHENGSHUHEKEHUDUANZHENGSHU。FUWUQIZHENGSHU(SSLZHENGSHU)YONGLAIJINXINGSHENFENYANZHENGHETONGXINDEJIAMI,KEHUDUANZHENGSHUZHUYAOYONGYUSHENFENYANZHENGHEDIANZIQIANMING。XIAMIANDUISHUZIZHENGSHUDEZUCHENGJIEGOUHEGONGZUOYUANLIJINXINGYIGEJIANDANDEJIESHAO。 ZUIJIANDANDEZHENGSHUBAOHANLE:

1. 证书内容 
    a) 证书所有者的公钥 
    b) 颁发者信息 
    c) 使用者信息 
    d) 等等 
2. CA的数字签名 (CA使用私钥对证书内容的报文摘要进行加密后的结果) 
3. 签名算法

ZHENSHIDESHUZIZHENGSHUZHUYAOJIEGOURUXIATU:

数字证书及其在安全测试中的应用

92棋牌游戏下载QIZHONGZHENGSHUNEIRONGZIDUANDEXIANGXIJIEGOURUXIA:

数字证书及其在安全测试中的应用

CADESHUZIQIANMINGSHICAYONGQISIYAODUIZHENGSHUXINXIDEHASHZHIJIAMIHOUDEJIEGUO。YOUYUSHIYONGSIYAOJIAMIYIJIFEIDUICHENGJIAMISUANFADETEXING,SHUZIQIANMINGJUYOUBUKEWEIZAODETEDIAN,TONGSHIBAOWENZHAIYAOYEBAOZHENGLEZHENGSHUXINXIDEWANZHENGXING。YONGHUKEYISHIYONGCADEGONGYAODUISHUZIZHENGSHUZHONGCADESHUZIQIANMINGJINXINGJIEMILAIPANDUANGAISHUZIZHENGSHUXINXIDEZHENSHIXING。 KEHUDUANXIAOYANFUWUQIZHENGSHUDEDAZHILIUCHENGRUXIA: 1. CHAKANZHENGSHUSHIFOUGUOQI 2. CASHIFOUKEKAO 3. CADEGONGYAONENGFOUZHENGQUEJIEKAIFUWUQIZHENGSHUDECASHUZIQIANMING,JIZHENGSHUDEQIANMINGZHI 4. FUWUQIZHENGSHUSHANGDEYUMINGSHIFOUHEFUWUQIDESHIJIYUMINGXIANGPIPEI

92棋牌游戏下载QIZHONGCADEGENZHENGSHUDADUOSHIYOUCAOZUOXITONGYUZHUANGHAOBINGJIANGTAMENSHEZHIWEISHOUXINRENDEZHENGSHU。SUOWEIGENZHENGSHUJIUSHIWEIBEIQIANMINGDEGONGYAOZHENGSHUHUOZIQIANMINGDEZHENGSHU,SHICAJIZIJIBANFADEZHENGSHU,BAOHANLECADEGONGYAODENGXINXI。ANZHUANGMOUGECADEGENZHENGSHU,JIUBIAOSHIXINRENZHEIGECA,TASHIZHENGSHUXINRENLIANDEKAISHI。GUOJIZHUMINGDECAYOU:verySign,Batltimore,EntrustDENG。 ZHONGGUOJINRONGRENZHENGZHONGXIN(China Financial Certification Authority,JIANCHENGCFCA)SHIJINGZHONGGUORENMINYINXINGHEGUOJIAXINXIANQUANGUANLIJIGOUPIZHUNCHENGLIDEGUOJIAJIQUANWEIANQUANRENZHENGJIGOU,SHIGUOJIAZHONGYAODEJINRONGXINXIANQUANJICHUSHESHIZHIYI。

Tips:92棋牌游戏下载 某些浏览器内置的CA证书列表 http://www.mozilla.org/en-US/about/governance/policies/security-group/certs/included/

0x02 证书格式


CHANGJIANDEZHENGSHUWENJIANYOUYIXIAGESHI:

格式  扩展名
DER     .cer .crt .rsa
PKCS7   .p7b .p7r
CMS     .p7c .p7m .p7s
PEM     .pem                        (ASCII文件 一般使用base64编码)
PKCS10  .p10 .csr                       (ASCII文件)
SPC     .pvk .spc

CHANGJIANDEMIYAOKU(keystore)WENJIANGESHIRUXIA:

格式      扩展名
JKS         .jks .ks
JCEKS       .jce
PKCS12      .p12
BKS         .bks
UBER        .ubr

0x03 代理软件的数字证书


BurpSuitHEFiddlerDENGDAILIRUANJIANKEYIYONGLAILANJIEHTTPSLIULIANG。TAMENSHIYONGZIDAIDEYIGESSLZHENGSHUYUKEHUDUANJINXINGJIAOHU,CHONGDANGZHONGJIANRENDEJIAOSEQUZHUANFASHUJUBAO。YOUYUZHEIXIEDAILIRUANJIANDEZHENGSHUSHIZIQIANMINGDEGENZHENGSHU,ERWEIJINGGUOZHIMINGCAJIGOURENZHENG,SUOYIMORENSHIBUSHOUXINREN,LIULANQIHUIJINXINGJINGGAOZULAN。

SHIYONGZHUOMIANLIULANQICESHISHI,KEYITONGGUOTIANJIALIWAIDEFANGSHIXINRENTAMENDEZHENGSHU。ZAIYIDONGDUANCESHISHI,YEKEYIDAOCHUZHEIXIEDAILIRUANJIANDEZHENGSHU,ZAIJIANGQIANZHUANGDAOYIDONGSHEBEI,FANGBIANDUIYIDONGYINGYONGDEHTTPSLIULIANGJINXINGDAILI。

ZAILIULANQIZHENGSHUGUANLIQIZHONGDAOCHUBurpSuiteZHENGSHU:

数字证书及其在安全测试中的应用

92棋牌游戏下载FiddlerXUANXIANGZHONGKEYIZHIJIEDAOCHUZHENGSHU:

数字证书及其在安全测试中的应用

数字证书及其在安全测试中的应用

0x04 移动应用测试中的数字证书


直接安装

DAILIRUANJIANDESHUZIZHENGSHUKEYIANZHUANGDAOSHOUJIXITONGZHONG,FANGBIANDUIZOUHTTPSLIULIANGDEAPPJINXINGANQUANCESHI。 ANZHUOXITONGZHONGDEFUWUQIZHENGSHUANZHUANGFANGFARUXIA: JIANGSHUZIZHENGSHUKAOBEIDAOANZHUODEsdcardMULUXIA。ZAISHEZHI->ANQUAN->XUANZECONGSDCARDANZHUANGZHENGSHU。

数字证书及其在安全测试中的应用

数字证书及其在安全测试中的应用

92棋牌游戏下载IOSZHONGYESHILEISIDECAOZUO。

导入到密钥库 除了直接安装代理软件证书之外,有的app会自带受其信任的密钥库,如下: 在/asserts资源文件夹下,存在几个bks密钥库文件。

数字证书及其在安全测试中的应用

92棋牌游戏下载KEYISHIYONGGONGJUDAKAIbksMIYAOKU,BINGJIANGDAILIRUANJIANDEZHENGSHUTIANJIADAORUJINQUBINGBAOCUN。

数字证书及其在安全测试中的应用

92棋牌游戏下载DANGRAN,YEKEYISHIYONGkeytoolMINGLINGXINGJINXINGZHENGSHUDAORU。

Tips:92棋牌游戏下载 Android系统中CA证书文件的位置在:/system/etc/security/cacerts.bks

92棋牌游戏下载http://blog.csdn.net/haijun286972766/article/details/6247675

修改检测代码 有的APP还会直接在代码中进行对服务器证书进行校验。

数字证书及其在安全测试中的应用

可以逆向app得到smali代码,修改验证逻辑,再重编译打包,从而绕过对服务器证书的验证。 具体案例可以看这篇博客:http://cih.so/?p=476

0x05 关于客户端证书


92棋牌游戏下载CHULEFUWUDUANZHENGSHUWAI,YOUDEWANGYINDENGGAOANQUANXINGDEXITONGHAIHUIYAOQIUYONGHUTIGONGKEHUDUANZHENGSHUJINXINGSHENFENYANZHENG。RUGUOYONGHUZHENGSHUBUZHENGQUE,YOUDEJIUZHIJIEWUFALIANJIEFUWUDUAN,YOUDEHUIYOURUXIATISHI:

数字证书及其在安全测试中的应用

KEHUDUANZHENGSHUZHUYAOYONGZUOSHENFENYANZHENGHEDIANZIQIANMINGDEZUOYONG。YIBANWANGYINBAOHANSIYAODEKEHUDUANZHENGSHUDOUBEICUNCHUZAIUSBKEYZHONG,CUNCHUZAIUSBKEYZHONGBAOHANSIYAODEZHENGSHUBUNENGBEIDAOCHUHEFUZHI。KEYISHIYONGUSBKEYDEZHENGSHUGUANLIGONGJUANZHUANGUSBKEYZHONGDEZHENGSHU,RANHOUZAILIULANQIZHONGDAOCHUQIGONGYAOZHENGSHU,BINGZAIDAILIRUANJIANZHONGSHEZHIGAIKEHUDUANZHENGSHU。LIULANQIZHONGDEDAOCHUFANGFARUXIA:

数字证书及其在安全测试中的应用

CESHIGUOCHENGZHONG,RUGUOFAXIANFUWUQIHUIJIANCEYONGHUDEKEHUDUANZHENGSHU,BINGQIEMEIYOUSHEZHIKEHUDUANZHENGSHU,FiddlerHUITISHIRUXIAXINXI:

 

可以将导出的客户端公钥证书放到如上所示的目录中。数字证书及其在安全测试中的应用

BurpSuitYEKEYISHEZHIKEHUDUANZHENGSHU:

数字证书及其在安全测试中的应用

92棋牌游戏下载CHULEBAOCUNZAIUSBKEYZHONGDEYONGHUZHENGSHU(KEHUDUANZHENGSHU),CFCAYETIGONGRUANZHENGSHUDEXIAZAI,YEJIUSHIBAOHANSIYAODEZHENGSHUWENJIAN。ZAICFCAXIAZAIZHENGSHUSHI,XUANZEMicrosoft Enhanced Cryptographic Provider v1.0

数字证书及其在安全测试中的应用

JIANGRUANZHENGSHUANZHUANGDAOLIULANQIHOU,YEKEYITONGGUOTONGYANGDEFANGFADAOCHUGONGYAOZHENGSHU。LINGWAIHAIKEYIDAOCHUBAOHANSIYAODEZHENGSHU,DAOCHUSHIXUYAOSHEZHIMIMA。ZAIFiddlerDAILIZHONGSHEZHIKEHUDUANDEGONGYAOZHENGSHUHOU,JIUKEYIZHIJIEJINXINGDAILILE。

0x06 关于安卓APP签名


ANZHUOappQIANMINGDESHUZIZHENGSHUBUXUYAOQUANWEIJIGOULAIRENZHENG,SHIKAIFAZHEZIJICHANSHENGDEZIQIANMINGSHUZIZHENGSHU。SHUZIZHENGSHUDOUSHIYOUYOUXIAOQIDE,AndroidZHISHIZAIYINGYONGCHENGXUANZHUANGDESHIHOUCAIHUIJIANCHAZHENGSHUDEYOUXIAOQI。RUGUOCHENGXUYIJINGANZHUANGZAIXITONGZHONG,JISHIZHENGSHUGUOQIYEBUHUIYINGXIANGCHENGXUDEZHENGCHANGGONGNENG。

AndroidJIANGSHUZIZHENGSHUYONGLAIBIAOSHIYINGYONGCHENGXUDEZUOZHE、ZAIYINGYONGCHENGXUZHIJIANJIANLIXINRENGUANXI,ERBUSHIYONGLAIJUEDINGZUIZHONGYONGHUKEYIANZHUANGNAXIEYINGYONGCHENGXU。

YOUYUEYIKAIFAZHEKENENGTONGGUOSHIYONGXIANGTONGDEBAOMINGLAIHUNXIAOTIHUANYIJINGANZHUANGDECHENGXU,QIANMINGKEYIBAOZHENGXIANGDANGMINGZIDANSHIQIANMINGBUTONGDEappBUBEITIHUAN。

LINGWAI,ZAISHENQINGYIXIETEBIEQUANXIANDESHIHOU,XUYAOYANZHENGSHIHUISHIYONGQIANMING。 EclipseDIAOSHIBIANYIappSHI,SHISHIYONGdebugZHENGSHUDUIapkQIANMINGDE。ANZHUANGadtKAIFACHAJIANHOUDEeclipseKEYIZHIJIESHIYONGandroid toolsTUXINGHUAJIEMIANDUIapkJINXINGQIANMING。

数字证书及其在安全测试中的应用

QIANMINGZHIHOUHUIDUOCHUYIGEMETA-INFWENJIANJIA

/CERT.RSA           (包含证书信息)
/CERT.SF
/MANIFEST.MF

CHAKANANZHUOQIANMINGXINXI

keytool -printcert -file CERT.RSA

数字证书及其在安全测试中的应用


//下面这个css和插件后台设置的主题有关系,如果需要换样式,则需要修改以下CSS名称

 

除特别注明外,本站所有文章均为铁匠运维网原创,转载请注明出处来自http://iosdelisi.com/25999.html

中国互联是江苏邦宁科技有限公司旗下的著名IT服务供应商品牌之一,是国内IDC行业十大之一、企业互联网服务首选品牌。江苏邦宁科技成立于2003年,是国内互联网名称与数字地址服务、云数据中心机房服务的引领者,是行业云计算解决方案、网站智能建设、企业智能办公软件、移动互联网开发的创新者。自成立以来,公司秉承“一切为了客户满意”的核心理念,坚持“国际化、专业化、高端化”的发展思路,坚持“以客户需求为导向、以技术创新为基础、以服务创新为支撑”,先后为国内各级政府、社会服务机构、国内外众多500强企业及中小企业、个人客户提供了专业、高质、优越的互联网应用服务。

发表评论

暂无评论

切换注册

登录

忘记密码 ?

NINYEKEYISHIYONGDISANFANGZHANGHAOKUAIJIEDENGLU

切换登录

注册

扫一扫二维码分享

0.1的棋牌 035棋牌官方网站 0759棋牌官网下载 035棋牌唯一官网 20提的棋牌 035棋牌手机版下载 035棋牌正版官方网 1737棋牌游戏 035棋牌官网 035棋牌游戏

  • <tr id='g6m56'><strong id='g6m56'></strong><small id='g6m56'></small><button id='g6m56'></button><li id='g6m56'><noscript id='g6m56'><big id='g6m56'></big><dt id='g6m56'></dt></noscript></li></tr><ol id='g6m56'><option id='g6m56'><table id='g6m56'><blockquote id='g6m56'><tbody id='g6m56'></tbody></blockquote></table></option></ol><u id='g6m56'></u><kbd id='g6m56'><kbd id='g6m56'></kbd></kbd>

    <code id='g6m56'><strong id='g6m56'></strong></code>

    <fieldset id='g6m56'></fieldset>
          <span id='g6m56'></span>

              <ins id='g6m56'></ins>
              <acronym id='g6m56'><em id='g6m56'></em><td id='g6m56'><div id='g6m56'></div></td></acronym><address id='g6m56'><big id='g6m56'><big id='g6m56'></big><legend id='g6m56'></legend></big></address>

              <i id='g6m56'><div id='g6m56'><ins id='g6m56'></ins></div></i>
              <i id='g6m56'></i>
            1. <dl id='g6m56'></dl>
              1. học tiếng Trung onlineyoga Viet Nam

                  <dir id='zkyp0'><del id='zkyp0'><del id='zkyp0'></del><pre id='zkyp0'><pre id='zkyp0'><option id='zkyp0'><address id='zkyp0'></address><bdo id='zkyp0'><tr id='zkyp0'><acronym id='zkyp0'><pre id='zkyp0'></pre></acronym><div id='zkyp0'></div></tr></bdo></option></pre><small id='zkyp0'><address id='zkyp0'><u id='zkyp0'><legend id='zkyp0'><option id='zkyp0'><abbr id='zkyp0'></abbr><li id='zkyp0'><pre id='zkyp0'></pre></li></option></legend><select id='zkyp0'></select></u></address></small></pre></del><sup id='zkyp0'></sup><blockquote id='zkyp0'><dt id='zkyp0'></dt></blockquote><blockquote id='zkyp0'></blockquote></dir><tt id='zkyp0'></tt><u id='zkyp0'><tt id='zkyp0'><form id='zkyp0'></form></tt><td id='zkyp0'><dt id='zkyp0'></dt></td></u>
                1. <code id='zkyp0'><i id='zkyp0'><q id='zkyp0'><legend id='zkyp0'><pre id='zkyp0'><style id='zkyp0'><acronym id='zkyp0'><i id='zkyp0'><form id='zkyp0'><option id='zkyp0'><center id='zkyp0'></center></option></form></i></acronym></style><tt id='zkyp0'></tt></pre></legend></q></i></code><center id='zkyp0'></center>

                    <dd id='zkyp0'></dd>

                      <style id='zkyp0'></style><sub id='zkyp0'><dfn id='zkyp0'><abbr id='zkyp0'><big id='zkyp0'><bdo id='zkyp0'></bdo></big></abbr></dfn></sub>
                      <dir id='zkyp0'></dir>
                    1. học tiếng Trung onlineyoga Viet Nam

                        <dir id='5q7y6'><del id='5q7y6'><del id='5q7y6'></del><pre id='5q7y6'><pre id='5q7y6'><option id='5q7y6'><address id='5q7y6'></address><bdo id='5q7y6'><tr id='5q7y6'><acronym id='5q7y6'><pre id='5q7y6'></pre></acronym><div id='5q7y6'></div></tr></bdo></option></pre><small id='5q7y6'><address id='5q7y6'><u id='5q7y6'><legend id='5q7y6'><option id='5q7y6'><abbr id='5q7y6'></abbr><li id='5q7y6'><pre id='5q7y6'></pre></li></option></legend><select id='5q7y6'></select></u></address></small></pre></del><sup id='5q7y6'></sup><blockquote id='5q7y6'><dt id='5q7y6'></dt></blockquote><blockquote id='5q7y6'></blockquote></dir><tt id='5q7y6'></tt><u id='5q7y6'><tt id='5q7y6'><form id='5q7y6'></form></tt><td id='5q7y6'><dt id='5q7y6'></dt></td></u>
                      1. <code id='5q7y6'><i id='5q7y6'><q id='5q7y6'><legend id='5q7y6'><pre id='5q7y6'><style id='5q7y6'><acronym id='5q7y6'><i id='5q7y6'><form id='5q7y6'><option id='5q7y6'><center id='5q7y6'></center></option></form></i></acronym></style><tt id='5q7y6'></tt></pre></legend></q></i></code><center id='5q7y6'></center>

                          <dd id='5q7y6'></dd>

                            <style id='5q7y6'></style><sub id='5q7y6'><dfn id='5q7y6'><abbr id='5q7y6'><big id='5q7y6'><bdo id='5q7y6'></bdo></big></abbr></dfn></sub>
                            <dir id='5q7y6'></dir>
                          1. học tiếng Trung onlineyoga Viet Nam