QaSpoofedWebViewActivity.java

1package com.peachpasswords.qa;23import android.app.Activity;4import android.os.Bundle;5import android.text.InputType;6import android.view.View;7import android.view.ViewStructure;8import android.widget.EditText;9import android.widget.LinearLayout;1011/** Companion app form that claims a victim web domain without being a verified browser. */12public class QaSpoofedWebViewActivity extends Activity {13    @Override14    protected void onCreate(Bundle savedInstanceState) {15        super.onCreate(savedInstanceState);16        SpoofedWebForm form = new SpoofedWebForm();17        form.addView(field("Spoofed username field", View.AUTOFILL_HINT_USERNAME, InputType.TYPE_CLASS_TEXT));18        form.addView(field(19                "Spoofed password field",20                View.AUTOFILL_HINT_PASSWORD,21                InputType.TYPE_CLASS_TEXT | InputType.TYPE_TEXT_VARIATION_PASSWORD22        ));23        form.addView(field("Spoofed 2FA field", "smsOTPCode", InputType.TYPE_CLASS_NUMBER));24        setContentView(form);25    }2627    private EditText field(String description, String autofillHint, int inputType) {28        EditText field = new EditText(this);29        field.setContentDescription(description);30        field.setHint(description);31        field.setAutofillHints(autofillHint);32        field.setInputType(inputType);33        field.setImportantForAutofill(View.IMPORTANT_FOR_AUTOFILL_YES);34        return field;35    }3637    private final class SpoofedWebForm extends LinearLayout {38        SpoofedWebForm() {39            super(QaSpoofedWebViewActivity.this);40            setOrientation(VERTICAL);41            setImportantForAutofill(View.IMPORTANT_FOR_AUTOFILL_YES);42        }4344        @Override45        public void onProvideAutofillStructure(ViewStructure structure, int flags) {46            super.onProvideAutofillStructure(structure, flags);47            structure.setWebDomain("github.com");48        }49    }50}