The Web UCLASS is an extension of Android's View class that allows you to display Web pages as part
of your activity layout.
So when developing an Android app, we can load a remote you or display HTML pages stored in our application
within an activity.
Using whatever you write sounds very useful.
So in this election, we're going to see the insecure implementation of Webbs you so this application
insecure bank allows the user to view statements after they have transferred funds from one account
to another.
So let's get started.
Now, as always, we'll make sure that the Android emulator and the application server are running.
And we can look at the view statements, activity in the source code.
And we can see that the activity is using a Web view to load and HTML files stored in external storage,
the name of which begins with statements underscore.
Now, we can also see that the developers enabled JavaScript in Westview with set JavaScript enabled
true.
Which is a method.
Now we can use Pinkard to identify the name of the file and its storage location due to the code system,
dot out, dot print, so it prints the files location into a standard output.
So run Pinkert and the package name of the app.
And here will log into the app.
And let's open the view statements activity.
And as you can see, this is the location of the file.
Now, since the file is loaded from external storage, the file is readable and readable by.
Everyone, do you say that with me?
So we can replace this fire with a new one which contains some JavaScript.
So this JavaScript will then be executed when the HTML pages are loaded.
And we'll exit with control, see?
Now create a new HTML file with the same name.
And we'll write a very basic JavaScript code just to see an alert.
So we'll save it and exit.
So now let's try and replace this new fire with the old one.
Run, ADB push and the HTML file.
And the location of the file to the end.
OK, so that loads the file, let's log into the app and see the changes.
So click on The View statements.
And look at that, we've uploaded the new HTML file and executed my JavaScript code.
How's that for a vulnerability?
The attackers can run malicious JavaScript code using this vulnerability right here in Web you.