java HTTPS请求绕过证书检测

浅浅的花香味﹌ 2023-10-06 19:00 48阅读 0赞

java HTTPS请求绕过证书检测

PKIX：unable to find valid certification path to requested target

package com.demo.test;
    
    
    import java.io.ByteArrayOutputStream;
    import java.io.IOException;
    import java.io.InputStream;
    import java.io.OutputStreamWriter;
    import java.net.URL;
    import java.net.URLEncoder;
    import java.security.cert.CertificateException;
    import java.security.cert.X509Certificate;
    import java.util.HashMap;
    import java.util.Map;
    
    import javax.net.ssl.HostnameVerifier;
    import javax.net.ssl.HttpsURLConnection;
    import javax.net.ssl.SSLContext;
    import javax.net.ssl.SSLSession;
    import javax.net.ssl.TrustManager;
    import javax.net.ssl.X509TrustManager;
     
    public class HttpClientUtils {
     
    	public static void main(String[] args) {
    		try {
    			String url = "https://127.0.0.1:8080/test?id=123&sign=" + URLEncoder.encode("S%#$#DKDI EO*$&!~@#", "UTF-8");
    			Map<String, Object> bodyParam = new HashMap<String, Object>();
    			bodyParam.put("age", 1);
    			bodyParam.put("name", "zhangsan");
    //			String sendPost = sendPost(url, JSONObject.toJSONString(bodyParam), "utf-8");
    //			System.out.println(sendPost);
    		} catch (Exception e) {
    			e.printStackTrace();
    		}
    	}
     
    	/**
    	 * https请求
    	 * @param urlParams 请求地址
    	 * @param bodyParams   body参数
    	 * @param charset  编码
    	 * @return
    	 */
    	public static String sendPost(String urlParams, String bodyParams, String charset) throws Exception {
    		HttpsURLConnection con = null;
    		OutputStreamWriter osw = null;
    		InputStream is = null;
    		ByteArrayOutputStream baos = null;
    		try {
    			URL url = new URL(urlParams);
    			con = (HttpsURLConnection) url.openConnection();
    			// 绕过证书验证
    			SSLContext sc = SSLContext.getInstance("SSL");
    			sc.init(null, new TrustManager[] { new TrustAnyTrustManager() }, new java.security.SecureRandom());
    			con.setSSLSocketFactory(sc.getSocketFactory());
    			// 绕过验证主机名和服务器验证方案的匹配是可接受的
    			con.setHostnameVerifier(new CustomizedHostnameVerifier());
    			con.setRequestMethod("POST");
    			con.setDoOutput(true);
    			con.setDoInput(true);
    			con.setUseCaches(false);
    			con.setRequestProperty("Accept", "application/json");// 响应json字符串
    			con.setRequestProperty("Content-Type", "application/json");// 请求body参数为json字符串
    			// con.setRequestProperty("Accept", "*/*");
    			// con.setRequestProperty("Connection", "keep-alive");
    			// con.setRequestProperty("Content-Type", "application/x-www-form-urlencoded");
    			// con.setRequestProperty("User-Agent", "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36");
    			if (bodyParams != null) {
    				osw = new OutputStreamWriter(con.getOutputStream(), charset);
    				osw.write(bodyParams);// 请求参数为json字符串
    				osw.flush();
    				osw.close();
    			}
    			is = con.getInputStream();
    			baos = new ByteArrayOutputStream();
    			byte[] buf = new byte[1024];
    			int len;
    			while ((len = is.read(buf)) != -1) {
    				baos.write(buf, 0, len);
    				baos.flush();
    			}
    			return baos.toString(charset);
    		} catch (Exception e) {
    			e.printStackTrace();
    			throw e;
    		} finally {
    			try {
    				if (osw != null) {
    					osw.close();
    				}
    				if (baos != null) {
    					baos.close();
    				}
    				if (is != null) {
    					is.close();
    				}
    				if (con != null) {
    					con.disconnect();
    				}
    			} catch (IOException e) {
    				e.printStackTrace();
    			}
    		}
    	}
     
    	static class TrustAnyTrustManager implements X509TrustManager {
    		public void checkClientTrusted(X509Certificate[] chain, String authType)
    				throws CertificateException {
    		}
    	 
    		public void checkServerTrusted(X509Certificate[] chain, String authType)
    				throws CertificateException {
    		}
    	 
    		public X509Certificate[] getAcceptedIssuers() {
    			return new X509Certificate[] {};
    		}
    	}
    	static class CustomizedHostnameVerifier implements HostnameVerifier {
    		// 重写验证方法
    		@Override
    		public boolean verify(String urlHostName, SSLSession session) {
    			// System.out.println("Warning: URL Host: " + urlHostName + " vs. " + session.getPeerHost());
    			// 所有都正确
    			return true;
    		}
    	}
    }