JS/HTML injection via SSID

[jn4kr]

As you can see it's possible to inject HTML/Javascript in the attack page via the ssid.

Steps to reproduce

1. Create a beacon with the tag you wan't to inject as SSID (e.g. <svg onload="alert('1')"/> )
2. Select the beacon as target
3. Switch to the attack page

Screenshots

[minanagehsalalma]

@jn4kr ...
Does android even process these WiFi names in the available wifis list ?!

[jn4kr]

Yeah. But i think it's off topic, so I'll sent you a mail about this topic.

[bddvlpr]

Project is kinda dead but once i really don’t know what to do, i’ll think about it.

[kingdevnl]

We might be able to strip out all HTML code using a REGEX?

[ghost]

Check thsi out: https://code-examples.net/en/q/129e949