在 Windows 10 中安装 Wireshark 后对 Shopify CLI 3.x 的抓包流程
1、参考：在 Windows 10 中安装 Fiddler Classic 后对 Shopify CLI 3.x 的抓包流程 。参考：在 Windows 10 中安装 Fiddler Everywhere 后对 Shopify CLI 3.x 的抓包流程。皆以失败告终。
2、选择网络接口：从 Wireshark 主窗口中，选择 Shopify CLI 流量将通过的网络接口。 由于我的是笔记本电脑，通过 Wi-Fi 连接网络，因此选择 WLAN，点击按钮：开始捕获分组。如图1
图1
3、在终端中执行中 Shopify CLI 的命令，以请求获取主题列表。如图2
图2
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 | PS E:\wwwroot\shopify-theme\theme-20230922> shopify theme list --verbose2023-10-09T08:05:28.924Z: Running command theme list2023-10-09T08:05:28.955Z: Ensuring that the user is authenticated with the Theme API with the following scopes:[]2023-10-09T08:05:28.956Z: Ensuring that the user is authenticated with the Admin API with the following scopes for the store shuijingwanwq-development.myshopify.com:[]2023-10-09T08:05:28.958Z: Getting session store...2023-10-09T08:05:28.965Z: Validating existing session against the scopes:[ "openid",]For applications:{ "adminApi": { "scopes": [], "storeFqdn": "shuijingwanwq-development.myshopify.com" }}2023-10-09T08:05:28.967Z: Sending Identity Introspection request to URL: https://accounts.shopify.com/oauth/introspection2023-10-09T08:05:28.969Z: Sending POST request to URL https://accounts.shopify.com/oauth/introspectionWith request headers: - User-Agent: Shopify CLI; v=3.49.3 - Keep-Alive: timeout=30 - Sec-CH-UA-PLATFORM: win32 - Content-Type: application/json2023-10-09T08:05:30.037Z: Request to https://accounts.shopify.com/oauth/introspection completed in 1044 msWith response headers: - cache-control: no-cache, no-store, private, must-revalidate, max-age=0 - content-type: application/json; charset=utf-8 - etag: W/"7d98625ff90e9b2d78e0e2a444b14481" - x-request-id: 72585f47-91c2-4944-81b7-8349d2ab8cbf2023-10-09T08:05:30.057Z: The identity token is valid: true2023-10-09T08:05:30.058Z:The validation of the token for application/identity completed with the following results:- It's expired: false- It's invalid in identity: false2023-10-09T08:05:31.155Z: Request to https://shuijingwanwq-development.myshopify.com/admin/api/unstable/themes.json?fields=id%2Cname%2Crole%2Cprocessing completed in 1089 msWith response headers: - content-type: application/json; charset=utf-8 - x-request-id: bb9a9fa0-d8e7-4374-ba47-4d9a6c0b10d02023-10-09T08:05:31.166Z: Getting development theme...2023-10-09T08:05:31.170Z: Getting host theme...name role id─────────────────────────────────────────────── ───────────────────── ─────────────Dawn 的更新版副本 [live] #133644189881Dawn [unpublished] #130440429753Sense [unpublished] #130698641593Crave 重命名 [unpublished] #130935947449Refresh [unpublished] #131376218297Colorblock [unpublished] #131376251065Dawn Customize [unpublished] #130580054201Taste 的更新版副本 的更新版副本 的更新版副本 的更新版副本 的更新版副本 的更新版副本 [unpublished] #132350771385shopify-theme-dawn-20221011/main [unpublished] #133060722873Dawn [unpublished] #133474844857Copy of Studio [unpublished] #133474975929Dawn (Shopify CLI) 9 [unpublished] #133492932793Dawn 的副本 的副本 1 [unpublished] #133635932345Colorblock [unpublished] #130698510521Taste [unpublished] #130698543289Craft [unpublished] #130698576057Development (639b5c-DESKTOP-QLPK8QM) [development] [yours] #1341094627132023-10-09T08:05:31.442Z:Running system process: · Command: ruby -v · Working directory: E:/wwwroot/shopify-theme/theme-202309222023-10-09T08:05:33.063Z: Request to https://monorail-edge.shopifysvc.com/v1/produce completed in 1582 msWith response headers: - x-request-id: 73b18bad-4378-4711-b2de-05386d867fa32023-10-09T08:05:33.066Z: Analytics event sent: { "command": "theme list", "time_start": 1696838728927, "time_end": 1696838731391, "total_time": 2464, "success": true, "cli_version": "3.49.3", "ruby_version": "3.1.1", "node_version": "18.18.0", "is_employee": false, "uname": "windows amd64", "env_ci": false, "env_plugin_installed_any_custom": false, "env_plugin_installed_shopify": "[\"@shopify/cli\",\"@shopify/plugin-did-you-mean\",\"@shopify/theme\"]", "env_shell": "cmd.exe", "env_device_id": "eb479d42673daf065d783e808d3de3b4870a4c02", "env_cloud": "localhost", "env_package_manager": "unknown", "cmd_all_launcher": "unknown", "cmd_all_topic": "theme", "cmd_all_plugin": "@shopify/theme", "cmd_all_verbose": true, "cmd_all_path_override": false, "args": "--verbose", "env_plugin_installed_all": "[\"@shopify/cli\",\"@shopify/plugin-did-you-mean\",\"@shopify/theme\"]", "metadata": "{\"extraPublic\":{},\"extraSensitive\":{}}"}2023-10-09T08:05:33.071Z: Completed command theme listPS E:\wwwroot\shopify-theme\theme-20230922> |
4、点击按钮：停止捕获分组。如图3
图3
5、通过 ping shuijingwanwq-development.myshopify.com 获取到对应的 IP 地址：23.227.38.74。如图4
图4
1 2 3 4 5 6 7 8 9 10 11 12 | PS E:\wwwroot\shopify-theme\theme-20230922> ping shuijingwanwq-development.myshopify.com正在 Ping shops.myshopify.com [23.227.38.74] 具有 32 字节的数据:来自 23.227.38.74 的回复: 字节=32 时间=207ms TTL=50来自 23.227.38.74 的回复: 字节=32 时间=209ms TTL=50来自 23.227.38.74 的回复: 字节=32 时间=250ms TTL=50来自 23.227.38.74 的回复: 字节=32 时间=204ms TTL=5023.227.38.74 的 Ping 统计信息: 数据包: 已发送 = 4，已接收 = 4，丢失 = 0 (0% 丢失)，往返行程的估计时间(以毫秒为单位): 最短 = 204ms，最长 = 250ms，平均 = 217ms |
6、在 Source 中找到：23.227.38.74，右键 – 作为过滤器应用 – 选中。如图5
图5
7、仅剩下 Source 为 23.227.38.74 的请求记录。协议中竟然不存在 HTTP，是 TCP 与 TLSv1.3，并且响应是密文。如图6
图6
8、参考：Transport Layer Security (TLS)。密钥日志文件是一种通用机制，即使正在使用 Diffie-Hellman (DH) 密钥交换，它也始终能够解密。
9、添加 SSLKEYLOGFILE 用户变量，可以指定浏览器在访问 SSL/TLS 网站时将对应的密钥保存到本地文件中，其值为：E:\Develop\SSLKEYLOGFILE\key.log。此机制目前（2019 年）不适用于 Safari、Microsoft Edge 和其他浏览器，因为它们的 TLS 库（Microsoft SChannel/Apple SecureTransport）不支持此机制。 此机制也适用于 Web 浏览器以外的应用程序，但它依赖于应用程序使用的 TLS 库。注意：基于 Chrom 的 Edge 版本（版本 79+）也应该可以工作。如图7
图7
10、配置 Wireshark，编辑 – 首选项 – Protocls – TLS。(Pre)-Master-Secret 日志文件名 (tls.keylog_file)：读取 TLS 密钥日志文件以进行解密的路径。TLS 调试文件 (tls.debug_logfile)：写入有关解密过程的内部详细信息的路径。 将包含解密结果以及此过程中使用的密钥。 这可以用来诊断解密失败的原因。如图8
图8
11、启用 TLS 解密还需要以下 TCP 协议首选项：Allow subdissector to reassemble TCP streams(允许细分器重新组装 TCP 流)。 默认启用。Reassemble out-of-order segments(重新组装无序段)（从 Wireshark 3.0 开始，默认禁用）需要启用。如图9
图9
12、确认浏览器已被完全关闭，可通过查看任务管理器再次确认。在终端中执行了相应命令后，查看捕获的流量，仍然与第 7 步骤类似，TLS 没有被解密。虽然两个日志的更新时间发生了变化。如图10
图10
13、不过在 Chrome 浏览器中访问：shuijingwanwq-development.myshopify.com 。查看捕获的流量，已经显示为 HTTP3，虽然仍然是密文。不符合预期。如图11
图11
14、现在需要解密 HTTP3，在浏览器中导出 证书。如图12
图12
15、配置 Wireshark，编辑 – 首选项 – Protocls – TLS。决定暂时搁置此方案，因为已经找到了更为合适的方案。参考：在 Windows 10 中安装 HTTP Toolkit 后对 Shopify CLI 3.x 的抓包流程
近期评论