Android < 4.4 AOSP (Stock) Browser UXSS: cross-domain cookie/response extraction module

I did not believe this at first, but after some testing it seems true: in AOSP browser before Android 4.4, you can load javascript into any arbitrary frame or window by prepending a NULL byte to a "javascript:..." string. This module automates loading and stealing HTML and cookies from cross-domain frames.

It was disclosed here few days ago: http://1337day.com/exploit/description/22581

I don't see a public advisory for this anywhere from the vendor. :(

Note: If the site you are trying to steal uses the X-Frame-Options header, you can enable `BYPASS_XFO` to serve a one-click exploit that pops open and reuses a window.

##### Verification

- [ ] Configure the module to steal the contents/cookies of `example.com`:

        msf> use auxiliary/gather/android_stock_browser_uxss
        msf> set TARGET_URLS http://example.com
        msf> run

- [ ] Run the module and browse to it in the Stock AOSP browser on any Android < 4.4
- [ ] You should see the captured HTML contents and (empty) cookie stored as loot

- [ ] Configure the module to use the XFO bypass and steal the contents/cookies of `http://www.google.com,https://m.facebook.com,https://www.yahoo.com`:

        msf> use auxiliary/gather/android_stock_browser_uxss
        msf> set BYPASS_XFO true
        msf> set TARGET_URLS http://www.google.com,https://m.facebook.com,https://www.yahoo.com
        msf> run

- [ ] Run the module and browse to it in the Stock AOSP browser on any Android < 4.4
- [ ] Click the link. The exploit takes a lonnng time but should eventually load each URL individually
- [ ] You should eventually see the captured HTML and (empty) cookie stored as loot

Any ideas on what to provide here as useful? I wouldn't mind seeing something a little more eye-popping here -- if it's long, you can even add it in as a `file:` and stash it somewhere under `data/exploits` (all OptStrings take a `file:` argument, see https://dev.metasploit.com/api/Msf/OptString.html )