Registering
V2EX  ›  Android

httpUrlConnection 和 httpclient 对证书验证提供空实现,会怎样被攻击

  •  
  •   Registering · Nov 11, 2015 · 13074 views
    This topic created in 3848 days ago, the information mentioned may be changed or developed.
    private class MyHostnameVerifier implements HostnameVerifier {
        @Override
        public boolean verify(String hostname, SSLSession session) {
            // TODO Auto-generated method stub
            return true;
        }
    
    }
    
    private class MyTrustManager implements X509TrustManager {
        @Override
        public void checkClientTrusted(X509Certificate[] chain, String authType)
                throws CertificateException {
            // TODO Auto-generated method stub
        }
    
        @Override
        public void checkServerTrusted(X509Certificate[] chain, String authType)
    
        throws CertificateException {
            // TODO Auto-generated method stub
        }
    
        @Override
        public X509Certificate[] getAcceptedIssuers() {
            // TODO Auto-generated method stub
            return null;
        }
    
    }
    

    有些 https 请求,如果不是 android 系统自带信任的证书,我们需要去拿服务器对应的证书放到本地,发送请求时带上,,
    也有一种方法,像上面的代码对证书验证的方法提供一个空实现,这样也可以访问,,这种做法会有怎样的安全风险,可以怎样被攻击

    5 replies    2015-11-12 09:00:24 +08:00
    cnhongwei
        1
    cnhongwei  
       Nov 11, 2015
    我想的话,如果是空实现,不验证证书,中间人可以使用自颁发的证书很轻松的进行中间人攻击了吧。
    songco
        2
    songco  
       Nov 11, 2015
    同楼上, 中间人攻击.
    xFrank
        3
    xFrank  
       Nov 11, 2015
    最常见的攻击场景:公共场合开放的 WiFi 热点
    Registering
        4
    Registering  
    OP
       Nov 11, 2015
    lincanbin
        5
    lincanbin  
       Nov 12, 2015 via Android
    httpclient 不是已经被废弃了吗?
    About   ·   Help   ·   Advertise   ·   Blog   ·   API   ·   FAQ   ·   Solana   ·   5975 Online   Highest 6679   ·     Select Language
    创意工作者们的社区
    World is powered by solitude
    VERSION: 3.9.8.5 · 61ms · UTC 03:09 · PVG 11:09 · LAX 20:09 · JFK 23:09
    ♥ Do have faith in what you're doing.