QaSpoofedWebViewActivity.java

1package com.peachpasswords.qa;23import android.app.Activity;4import android.os.Bundle;5import android.view.View;6import android.webkit.WebView;78/** Companion app page that claims a victim domain without being a verified browser. */9public class QaSpoofedWebViewActivity extends Activity {10    @Override11    protected void onCreate(Bundle savedInstanceState) {12        super.onCreate(savedInstanceState);13        WebView webView = new WebView(this);14        webView.setContentDescription("Spoofed victim-domain page");15        webView.getSettings().setJavaScriptEnabled(true);16        webView.loadDataWithBaseURL(17                "https://github.com/login",18                "<form><input aria-label='Spoofed username field' autocomplete='username' autofocus>"19                        + "<input aria-label='Spoofed password field' type='password' autocomplete='current-password'>"20                        + "<input aria-label='Spoofed 2FA field' autocomplete='one-time-code'></form>",21                "text/html",22                "UTF-8",23                null24        );25        webView.setImportantForAutofill(View.IMPORTANT_FOR_AUTOFILL_YES);26        setContentView(webView);27    }28}