Bypassing Browser Security Policies for Fun and Profit
summary
Demonstrates concrete Android browser failures: multiple Same Origin Policy bypasses in WebView (pre‑4.4) exploited with null‑byte and object/iframe tricks, a Google Play 413 framing path that leads to simulated remote installs (RCE chain), and cross‑scheme attacks that read file:// resources and steal cookies including HTTPOnly. Builds and runs Metasploit modules and a sample exploit flow that forces download + open to exfiltrate /etc and SD card files. Releases a 40+ test cases security suite; TrendMicro-style scan shows 42% affected among Play Store browsers.
AI-written summary · about
chapters (19)
- 0:00Intro
- 1:19Agenda
- 3:21Testing methodology & References
- 4:15Introduction Same Origin Policy
- 7:22SOP Bypasses For Android Browsers
- 7:51SOP Bypass 1 - CVE 2014-6041 (POC)
- 11:21SOP Bypass 2 - POC
- 13:05Google Play's Web Remote Installation Feature
- 14:08Introduction: Cross Scheme Data Exposure
- 14:59CSDE Vulnerability Android Stock Browser
- 15:38Cross Scheme Data Exposure Attack Plan
- 16:36Android Gingerbread CSDE (POC)
- 17:02Android Jellybean CSDE (POC)
- 19:43CSP And Mobile Browsers
- 21:01Problem with Mobile Browsers And CSP
- 22:16Android Patch Management issues
- 23:12How Apple Panch management Works? (Will's Graphs)
- 23:49How Everything else works
- 24:50Blackhat Sound Bytes
related talks
32mHack Your Own App: Getting Started with Mobile Penetration Testing
07m"The significance of mobile exploit applications"
43mThe Most Secure Browser? Pwning Chrome from 2016 to 2019
41mOverview of common Android app vulnerabilities
32mDirty Stream Attack, Turning Android Share Targets Into Attack Vectors
41mThinking Outside the Sandbox - Violating Trust Boundaries in Uncommon Ways
43mAttacking Android Applications
40mSo, You Want To Use A WebView? [BAD AUDIO]