Skip to main content

Exploitation Of Improper WebView Implementation

Hey Guys  today we explore Web view in  android application and   how their misconfiguration leads to Cross site scripting , open redirection , html injection in application.

WHAT IS Web View?
Android Web View is used to display web page in android. The web page can be loaded from same application or URL. It is used to display online content in android activity. Android Web View uses webkit engine to display web page.The android.webkit.WebView is the subclass of Absolute Layout class.
 Web Views are used in android applications to load content and HTML pages within the application.

     For example:

Improper Implementation of Web view

 1. Loading Clear Text content
 If a Web View load url that is on http(Clear text communication)  then it would be open to various forms of attack such as MiTM.
                                          webview.loadUrl("http://hellobbc.com");

2 Improper ssl error Handling:
 Nowadays Developer Implement SSL PINNING in android application to protect from any proxy tool to capture request of application .
 If an proxy tool want to capture the application traffic then some application thrown SSL error and  Web View will not load web content if errors are detected during the SSL/TLS negotiation.
An attacker can  extract information  from ssl error and bypass mechanism to SSL errors is implemented, This means that the application is vulnerable to MiTM attacks as it could allow an attacker to read or modify content that is displayed to the user since any certificate would be accepted by the application.

3.No sanitization of special characters when loading data in Web View
 When application Load data in Web view is not sanitized or no any  escaping performed that leads to html injection or cross site scripting . Cross site scripting possible when JavaScript is enabled
An attacker can extract locally stored information in application and also can send phishing page to user for further attack.

For example:

4.Improper Uri Validation
 Nowadays almost developers implement app links or deep links in application that are basically URLs which navigate users directly to the specific content in applications.

In this implementation developer create a mistake he forgot to verify proper uri path . That leads to application vulnerable to open  redirection , cross site scripting . As saying above cross site scripting is possible if JavaScript Is enabled.


EXPLOITATION:

Check out my video:



REMEDIATION:
  •  The use of HTTP protocol should be replaced by HTTPS. Using SSL/TLS requires a properly signed certificate installed on the web server but it is a completely worth implementation
  • If Application load data that is inputed by user that data should be sanitized before processing.
  • Uri path should be properly checkedWebView Activity should be exported =false

For Practical Please go to my github repo- https://github.com/ninza-hacker/webview-Exploitation  and download the code and import into android studio

References:
Labels:

Comments

Post a Comment

Popular posts from this blog

Exploitation of Improper Export of Activities In Android Application

In android You know that every GUI interface is an  separate activity. An activity represents a single screen with a user interface just like window or frame of Java. In An application there are many activities depend on application functionalities. Let's take a example : An application that have   three modules login , register and   dashboard . For that there are there are three different activities for all these modules. What is export Means Here? In Android Application there is an attribute android: exported =true or false . This attribute is used in android   to provide an access to   other third party application to start their service , activities   and receive broadcast   messages. Like for an Example : If an application    have broadcast receiver to receive any events or message , if in that application exported attribute is set to true then this    broadcast message   can also receive by other thi...
Post a Comment
Read more

Passcode Protection Bypass By Brute Forcing On zoho (Cliq Application)

First We discuss about what is passcode and Why it is Implemented in  Mobile Applications. PASSCODE Implemented in Mobile Application to protect Applications from an Unauthorized Access.like for example your cliq or any application account is logged in mobile phone .any your friend ask you to give phone , your friend try to open cliq application to see your message, but your friend cant open the application without entering passcode . he have to enter passcode for open, so it is an extra layer security in  applications. Passcode protection implemented in Android Application is an extra layer security to protect an unauthorized access. How Passcode Protection is bypassed by Bruteforcing? You know that passcode protection or pin protection in mobile applications have some attempt to enter passcode , if you enter  wrong passcode more than 5 times or 10 times based on application security , User logged out automatically and redirected to login page.but due to some ...
3 comments
Read more

A New Way Of Brute force Passcode/Pin Protection By deep link

DESCRIPTION : AS you know already that what is passcode protection and why it is applied ? And how it is bypassed normally ? If you don’t know please read my previous blog:   https://negativewives.blogspot.com/2020/04/passcode-protection-bypass-by-brute.html                                                                                When any passcode protection is implemented first check any activity is exported or not ? Here we  only talking the scenario where no activity is exported in application   PROCEDURE : Open Application after implementing passcode protection. You see that passcode activity is launched first Go to AndroidMainfest.xml file and check launch mode of passcode activity . Question Arises in your mind   - ...
Post a Comment
Read more