0x01 概述

本文将介绍安卓模拟器环境下面使用tcpdump抓包的方法,适合小白用户查看。

0x02 安装指南

2.1 环境信息


笔记本: MacBook Pro 2020款 13寸
MacOS: 10.15.5
模拟器: 网易Mumu 1.9.15,已开启root权限
Wireshark: 3.2.4

2.2 安装脚本

#!/bin/bash

shell_script_path=$(cd `dirname $0`; pwd)

tcpdump_local_path="${shell_script_path}/tcpdump"

if [ ! -f "${tcpdump_local_path}" ]; then
  cd ${shell_script_path}
  curl -O http://www.androidtcpdump.com/download/4.9.0/tcpdump
  echo -e "download tcpdump at path ${shell_script_path}"
fi

if [ -f "${tcpdump_local_path}" ]; then
    echo -e "findout tcpdump ${tcpdump_local_path}"
else
    echo -e "download tcpdump fail"
    exit 1
fi
adb push "${tcpdump_local_path}" /data/local/tcpdump
adb shell chmod 6755 /data/local/tcpdump
echo -e "install tcpdump success"
echo -e "You can use like
adb shell as root!
cd /data/local/
./tcpdump -i any -p -s 0 -w /sdcard/capture.pcap

Then exit shell
adb pull /sdcard/capture.pcap .
"

echo -e "Do you want delete tcpdump file (y) ?"
read isDeleteDownload
if [ ${isDeleteDownload} == "y" ]; then
  rm -f ${tcpdump_local_path}
  echo -e "success remove ${tcpdump_local_path}"
fi

2.3 手动安装

1、tcpdump for android 在这里下载:

2、使用adb push命令将tcpdump上传到安卓模拟器中,然后添加执行权限

adb push ~/Downloads/tcpdump /data/local/tcpdump
adb shell chmod 6755 /data/local/tcpdump

0x03 操作指南

tcpdump 需要在命令行运行目录中存在

cd /data/local
./tcpdump -i any -p -s 0 -w /sdcard/capture.pcap

拉取抓获的tcp/udp包

adb pull /sdcard/capture.pcap

wireshark打开capture.pcap即可分析log

tcpdump 参数说明

"-i any": listen on any network interface
"-p": disable promiscuous mode (doesn't work anyway)
"-s 0": capture the entire packet
"-w": write packets to a file (rather than printing to stdout)
... do whatever you want to capture, then ^C to stop it ...

本文转自:https://www.jianshu.com/p/ca6cdc825ad3


版权声明:本文为原创文章,版权归独自等待所有,转载请注明出处!

本文链接:https://www.waitalone.cn/mobilesecurity/androidtcpdump.html

友情提示:如果博客部分链接出现404,请留言或者联系博主修复。
Last modification:June 29th, 2020 at 12:01 pm
如果觉得我的文章对你有用,请随意赞赏