菜单
Exploit insecure mobile WebViews — JS-bridge abuse, file access, and XSS→native. Load when an app renders web content in a WebView/WKWebView, exposes a JS bridge, or loads attacker-influenced URLs. Signals: addJavascriptInterface, WKScriptMessageHandler, loadUrl, file:// access, deep-link → WebView.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/NoorQureshi/SploitAgent --skill mobile-webview命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
正在显示 SKILL.md
| name | mobile-webview |
| description | Exploit insecure mobile WebViews — JS-bridge abuse, file access, and XSS→native. Load when an app renders web content in a WebView/WKWebView, exposes a JS bridge, or loads attacker-influenced URLs. Signals: addJavascriptInterface, WKScriptMessageHandler, loadUrl, file:// access, deep-link → WebView. |
| domain | mobile |
| type | technique |
| stability | learning |
| modes | ["bugbounty","pentest"] |
| severity | high |
| owasp | ["M4:2024-Insufficient-Input-Output-Validation"] |
| cwe | ["CWE-749","CWE-79"] |
| tools | ["jadx","frida"] |
| schema_version | 1 |
The app shows web content in a WebView (Android WebView / iOS WKWebView) and either exposes a
native JS bridge or loads URLs/content an attacker can influence (deep link, param, MITM'd http).
WebViews blur the web/native boundary. A JS bridge (addJavascriptInterface /
WKScriptMessageHandler) lets page JavaScript call native code — so XSS or a malicious loaded page
can invoke native functionality. Misconfig (setAllowFileAccess, setJavaScriptEnabled, mixed
content) widens it to local file theft.
jadx/class-dump: setJavaScriptEnabled(true),
addJavascriptInterface(obj,"name") (Android <17 = any method exposed), setAllowFileAccess,
setAllowUniversalAccessFromFileURLs, and what URLs it loads.loadUrl,
a param reflected into the page (XSS), or MITM if it loads http:// (ATS/cleartext).window.name.method(...)) — read files, get device data, trigger actions the bridge exposes.file:// loads + universal file access → read app-private files; content:// tricks.addJavascriptInterface on old targetSdk exposes reflection → RCE-ish; on modern it's limited to @JavascriptInterface methods — enumerate those.WKWebView message handlers are the equivalent bridge — check userContentController.Injected JavaScript invokes native functionality via the bridge (data read, action performed), or local files are exfiltrated through the WebView.
OWASP MASTG (platform/WebView); Android WebView security docs; "WebView bridge abuse" write-ups.