Now, Android provides the clipboard framework for copying and pasting different types of data.
So it's possible to view the contents of this clipboard by instantiating an object of clipboard manager
by calling the get system service method.
So let's see how we can do it.
To demonstrate his vulnerability, we can open the transfer activity and copy the account number to
the clipboard.
Right, a random number and copy it.
Next, we'll need the account number of the application.
So I can use the command and grep for this.
OK, so it looks like it's you zero, a one, two, four.
So now let's run it, shall see you use zero, underscore a one to four service called Clipboard to
ask one six and the package name.
The service, called Clipboard Command, instantiates an object of the clipboard manager by calling
the get system service method.
So the service codes.
Are one, two and three.
Forget clipboard, text, set, clipboard, text, and has clipboard text, respectively.
The F-16 argument writes the UTF 16 string astar into the send parcel.
All right, so after entering this command, the cockpit data should be here, but it has limited access
to clipboard data on Android Android, 10:00 or later.
So why don't we have a look at the official walkthrough for insecure bank and see what this vulnerability
looks like?
Let's go to the GitHub page of the app.
So go ahead and open the walkthrough folder.
And click on the pasteboard vulnerability.
Download the document and open it up with Microsoft Word.
Scroll down a bit.
And as you can see in older versions of Android, after running this command, you can get the clipboard
texts.