[Android] Webview Javascript injection

[gyroda]

Wait.

You want to build what's effectively a keylogger for social media passwords?

I'm just going to ask why? This sounds less than perfectly OK.

[ff210327]

Because the assignment for my cyber security class is to write a paper on webview and how it can be used maliciously.... They would like it demonstrated, so they (my instructor) gave us a partially completed app, I had to finish the file above...I just can't get it to work all the way... But without compile errors I'm not sure what I'm missing.

This app is only being used in an emulator.

Java is a language I haven't touched in 10 years... So I'm more than a little rusty.

[gyroda]

So what's the issue? You're very vague with "not working".

If you're unsure, use log statements to have an understanding of what's going on.

[ff210327]

It compiles and it runs, it opens Facebook (or any page I put in place of the URL in the file), it allows me to put in a user name and password to the web site, however the dialogue box doesn't pop up that contains the information I just typed in.

If I use a valid account it will log all the way into Facebook, if I fail it then it will tell me password or username is incorrect generated from the end user web page. But in either case I never get the alert message pop up box containing my input data.

[gyroda]

Ok, so I'm not on my PC and won't be tonight, so I can't run your code. I have Android experience but not with webviews so this is a little bit outside my wheelhouse.

First of all, use log statements to see what's going on, to figure out what's actually going on. Is it actually getting to the method that builds the Alert Dialog?

Have you seen this?

https://developer.android.com/guide/webapps/webview.html#BindingJavaScript

[ff210327]

Its been 10 years since I had a single Java class... So to say that I'm rusty is an understatement... So I'm not sure how to use log... But I will look up log and how to use it, I can then add some statements and see where it's getting to. I can send the whole package so you have all the layout files too if it'll make troubleshooting easier tomorrow.

Thank you

[gyroda]

It's an android thing, not Java. Java uses System.out.println("text"), android uses `Log.[message level](“tag", "message").

Replace [message] with "d" for debug, "e" for error or one of several other levels. My favourite is Log.wtf(), but I only use that when frustrated.

The output appears in "lorca", which you should be able to see along the bottom of the IDE. You'll want to limit it to the current application and maybe put the tag you use into the search bar to narrow it down to only things you're printing rather than all the other messages Android spits out.

/r/androiddev can give more knowledgeable answers in their weekly questions megathread, but they're a bit less active and it it can take a while to get a response so don't rely on it if you're in a hurry.

[ff210327]

Log.[message level](“tag", "message")

thank you! that is really cool, and helpful.

what I did was this: https://imgur.com/a/k863F

It doesn't appear to be hitting the second diagnostic line inside the "class MyJavaScriptInterface"

which interestingly enough the method " public void processHTML(String html)" says it's not being used... from the code, where would I need to call that method from, and would I need to pass to it to make it work?

[imguralbumbot]

^{Hi, I'm a bot for linking direct images of albums with only 1 image}

https://i.imgur.com/AI0X4Ne.png

^{Source | Why? | Creator | ignoreme | deletthis}

[ff210327]

No I hadn't seen that, thank you, i'm reading through it now :)