For some time now I haven't succeeded in triggering password autofill in any iOS browser from a downloaded HTML file (which would allow another easy way to steal passwords). There are no Same Origin Policy constraints for local HTML files, so it seems easy to just open the target website and read the password, but there are some problems:
- password autofill does not work in cross-domain frames in iOS browsers based on UIWebView
- calling window.open() overwrites the calling window, so I cannot control content while having the target website open
- I didn't find any other way to set location.host or mainDocumentURL.host to target domain while still controlling the content
I guess there may be some solution which I overlooked, so here is the challenge for you:
A sample application with the code above - which you may run on iOS simulator - is available on GitHub. The task is to prepare a local HTML file (/tmp/challenge1.html) in such way that "You completed the challenge" line will get executed.
There is no reward unfortunately, apart from a humble "thank you" during our SyScan360 talk :-)
Maybe I'm mis-understanding but IIRC Chrome for iOS uses its own networking which means it supplies the data to the UIWebView. Given that it's supplying the data it could add its own? In other words it could inject scripts. Those scripts could then read passwords as typed (not auto-fill) and or as sent and send them back to the app.
Maybe I'm mis-understanding but IIRC Chrome for iOS uses its own networking which means it supplies the data to the UIWebView. Given that it's supplying the data it could add its own? In other words it could inject scripts. Those scripts could then read passwords as typed (not auto-fill) and or as sent and send them back to the app.
ReplyDeleteIs that correct?