package com.peachpasswords.qa; import android.app.Activity; import android.os.Bundle; import android.text.InputType; import android.view.View; import android.view.ViewStructure; import android.widget.EditText; import android.widget.LinearLayout; /** Companion app form that claims a victim web domain without being a verified browser. */ public class QaSpoofedWebViewActivity extends Activity { @Override protected void onCreate(Bundle savedInstanceState) { super.onCreate(savedInstanceState); SpoofedWebForm form = new SpoofedWebForm(); form.addView(field("Spoofed username field", View.AUTOFILL_HINT_USERNAME, InputType.TYPE_CLASS_TEXT)); form.addView(field( "Spoofed password field", View.AUTOFILL_HINT_PASSWORD, InputType.TYPE_CLASS_TEXT | InputType.TYPE_TEXT_VARIATION_PASSWORD )); form.addView(field("Spoofed 2FA field", "smsOTPCode", InputType.TYPE_CLASS_NUMBER)); setContentView(form); } private EditText field(String description, String autofillHint, int inputType) { EditText field = new EditText(this); field.setContentDescription(description); field.setHint(description); field.setAutofillHints(autofillHint); field.setInputType(inputType); field.setImportantForAutofill(View.IMPORTANT_FOR_AUTOFILL_YES); return field; } private final class SpoofedWebForm extends LinearLayout { SpoofedWebForm() { super(QaSpoofedWebViewActivity.this); setOrientation(VERTICAL); setImportantForAutofill(View.IMPORTANT_FOR_AUTOFILL_YES); } @Override public void onProvideAutofillStructure(ViewStructure structure, int flags) { super.onProvideAutofillStructure(structure, flags); structure.setWebDomain("github.com"); } } }