rapid7/metasploit-framework — pull request #3759 by jvennix-r7 (2014-09-08 04:36:57+00:00)
Title: Android aosp uxss

I did not believe this at first, but after some testing it seems true: in AOSP browser before Android 4.4, you can load javascript into any arbitrary frame or window by prepending a NULL byte to a "javascript:..." string. This module automates loading and stealing HTML and cookies from cross-domain frames.

It was disclosed here few days ago: http://1337day.com/exploit/description/22581

I don't see a public advisory for this anywhere. :(

Note: If the site you are trying to steal uses the X-Frame-Options header, you can enable `BYPASS_XFO` to serve a one-click exploit that pops open and reuses a window.

##### Verification

- [ ] Configure the module to steal the contents/cookies of `example.com`:

msf> use `auxiliary/gather/android_stock_browser_uxss`
msf> set TARGET_URLS http://example.com
msf> run

- [ ] Run the module and browse to it in the Stock AOSP browser on any Android < 4.4
- [ ] You should see the captured HTML contents and (empty) cookie stored as loot

- [ ] Configure the module to use the XFO bypass and steal the contents/cookies of `http://google.com,http://facebook.com,http://yahoo.com`:

msf> use `auxiliary/gather/android_stock_browser_uxss`
msf> set TARGET_URLS http://google.com,http://facebook.com,http://yahoo.com
msf> run

- [ ] Run the module and browse to it in the Stock AOSP browser on any Android < 4.4
- [ ] Click the link. The exploit takes a lonnng time but should eventually load each URL individually
- [ ] You should eventually see the captured HTML and (empty) cookie stored as loot