Files
Abstract
WebCapsule is a record and replay forensic engine for web browsers. It can assist forensic analysts to reconstruct and analyze real world web security attacks such as social engineering and phishing attacks. WebCapsule is always on, lightweight, portable and collects critical information. WebCapsule is designed and implemented as a self-contained instrumentation layer around Google's Blink web rendering engine and V8 JavaScript engine. Blink is already embedded in a variety of browsers and can run on different platforms, which makes WebCapsule portable. In this research, we instrument WebCapsule on Android WebView to verify the portable nature. WebView allows us to display web pages in Android Apps. We build Android System WebView with embedded WebCapsule and show that it is possible to record and replay web contents in WebView of Android applications. We evaluate the efficiency of the System WebView with embedded WebCapsule on a self-developed app and few real-world apps.