- Hello all and welcome to the new video of Android Security an Exploitation by
Pentester Academy. My name is Aditya and I am your course instructor for this entire
training series. So this course is being run on http://PentesterAcademy.com and you
can also checkout the certifications at http://securitytube-training.com. So in
this particular video, we are going to have a look at Webview based
vulnerabilities for Android. Now you might be wondering what is a Webview for a
mobile application. So Webview is simply a browser content being rendered into a
mobile application. So it could be a webpage which is hosted remotely and then
it is displayed inside the application as a part of the application itself. But what
actually happens is that the application is kind of acting like an embedded browser
which is displaying you the web content. So, in any scenario or any of the web
application or web component will have several elements inside it. So, it could
be a JavaScript, it could be a CSS or it could be any other element. Now for
example, if the web content has a JavaScript element, will the JavaScript
element be executed in the mobile application context and the answer is yes.
If the application defines a JavaScript Bridge in order to execute JavaScript then
the remote JavaScript from the web component will get executed. Once the
JavaScript component gets executed, it can basically interact with any of the Java
code inside the application. So, it can call remote or in this case the
application is Java Code Methods as well as it can create maybe a new files or add
new application and all these kind of things. So anything that the application
can do and is accessible by JavaScript that is something which you can also do if
you find a vulnerability of Webview. So, when this vulnerability was first
discovered or became first popular as in September 2013, almost 70 % of the
applications used to use Webview and this is mostly because most of the application
which are free apps use some kind of advertisement components which display
elements remotely from the website and that at the end uses Webview. So you can
checkout this particular URL for a in-depth detail of the Webview based
vulnerability and what you can do with Webview based exploitation as well. But
for now we will keep the things simple and we'll see how to identify and exploit a
very basic Webview vulnerability. So also before moving further, at the time of
discovery of the Webview vulnerability almost eight out of ten popular ad
libraries were vulnerable. Around 95 % of the entire Android user community was also
vulnerable to this attack. So as you can see this is a pretty critical
vulnerability which the developers often miss out while writing the applications.
So, I've written down a sample application which is a GitHub clone of the VulnWebView
repo written by Jay Dough. So this is how the application looks like. The package
name is vulnerable.attify.webviewapp and it simply defines a Webview element and
sets the JavaScript to True and then adds a JavaScript interface element with
Vulninterface. The URL it tries to load is one of my local IPs URL and then it also
has a bunch of other methods which can be accessible with Webview or in this case
JavaScript. My interface which is actually this one has been defined over here.
Let's try to go ahead and run this application and see what happens. So let
me just first startup Santoku and startup a local python server over here. The IP is
192.168.161.139. This will change over here. Let's give it the quote as well.
Here, we have a index.html file, which is just saying Android Webview vulnerability
and then has some body element. Let's go ahead and start up a web server. We have
got a Genymotion running over here, also at the same time the proxy is also setup.
I will just show you over here. The proxy is setup to my local systems port. Let's
drop this request and let's go ahead and run this application. Now the application
has started and simply says hack all the phones. Let's turn the intercept to on and
refresh this and we see that request going on over here and if you forward this, you
see that the response is coming back with hack all the phone. Now let's try to add a
particular JavaScript component over here. I will simply do a script
type="text/javascript"> and write a very simple javascript which maybe just shows
Webview vulnerability. Closing the script task and forwarding this. Now if you go
back to the application, you see that this has the Webview vulnerability over here.
So this is how you can simply inject a very basic JavaScript. But what we are
trying to do is seeing if we can interact with the device and may be make some
system or file system changes in the device. Let's make the intercept to one
and I have a sample JavaScript written over here which simply goes ahead and
deletes this file webviewCookiesChromium. This is something which will happen, so I
have declared the path and then written a function execute which take the command as
an argument and first of all, it writes a Webview vulnerability and then it goes
ahead and executes the command which says system/bin/rm, and removes the file
specified in the path. So let's first of all check if the file is present over
there. So go to Santoku, adb connect. Disconnect and connect back again. If you
go inside adb shell, /data/data/vulnerable.attify.webviewapp.
Go inside databases. So currently I have this webviewCookiesChromium.db and this is
the file which we will try to delete. So deleting is just the very basic example of
how you can interact with the file system and make some modifications over there.
And if you notice I have added this one interface which is the name of my
JavaScript interface. This particular interface name. So let's try to go ahead
and run the application again. It gets intercepted in Burp. And
we wait for the response. Failed to connect. Refresh it. I think something
might went wrong. Okay so we don't have the web server running. So let's run it
and then try again. So we get the request and we have the response over here. So
let's just add this JavaScript and see what happens. We'll go to the body tag and
write script type="text /javascript". Add this JavaScript code and close the script
tags. So everything looks good over here so far, sweet. Got rendered and I have
this particular JavaScript got executed which was a document.write . And now if I
check the databases, if you see that we don't have webviewCookiesChromium.db,
because we just now deleted it using the Webview vulnerability. So this is a very
basic exploitation of what you can do with Webview based vulnerabilities. So in the
next video, we'll have a more in-depth look of Webview based vulnerabilities and
seeing some alternative ways of identifying and exploiting Webview
vulnerabilities. Thanks for watching the video and I hope you like it. If you have
any further feedback or queries, feel free to reach out to me at adi@attify.com or
you can tweet out to me at adi1391. Thank you.