exploiting-deeplink-vulnerabilities

name	exploiting-deeplink-vulnerabilities
description	Tests and exploits deep link (URL scheme and App Link) vulnerabilities in Android and iOS mobile applications to identify unauthorized access, data injection, intent hijacking, and redirect manipulation. Use when assessing mobile app attack surface through custom URI schemes, Android App Links, iOS Universal Links, or intent-based navigation. Activates for requests involving deep link security testing, URL scheme exploitation, mobile intent abuse, or link hijacking.
domain	cybersecurity
subdomain	mobile-security
author	mahipal
tags	["mobile-security","android","ios","deep-links","owasp-mobile","penetration-testing"]
version	1.0.0
license	Apache-2.0
nist_csf	["PR.PS-01","PR.AA-05","ID.RA-01","DE.CM-09"]

Exploiting Deep Link Vulnerabilities

When to Use

Use this skill when:

• Assessing mobile app deep link handling for injection and redirect vulnerabilities
• Testing Android intent filters and iOS URL scheme handlers for unauthorized access
• Evaluating App Links (Android) and Universal Links (iOS) verification
• Testing for link hijacking via competing app registrations

Do not use without authorization -- deep link exploitation can trigger unintended actions in target applications.

Prerequisites

• Android device with ADB or iOS device with Objection/Frida
• APK decompiled with apktool or JADX for AndroidManifest.xml analysis
• Knowledge of target app's registered URL schemes and intent filters
• Drozer for Android intent testing
• Burp Suite for intercepting deep link-triggered API calls

Workflow

Step 1: Enumerate Deep Link Entry Points

Android - Extract from AndroidManifest.xml:

# Decompile APK
apktool d target.apk -o decompiled/

# Search for intent filters with deep link schemes
grep -A 10 "android.intent.action.VIEW" decompiled/AndroidManifest.xml

# Look for:
# <data android:scheme="myapp" android:host="action" />
# <data android:scheme="https" android:host="target.com" />

iOS - Extract from Info.plist:

# Extract URL schemes
plutil -p Payload/TargetApp.app/Info.plist | grep -A 5 "CFBundleURLSchemes"

# Extract Universal Links (Associated Domains)
plutil -p Payload/TargetApp.app/Info.plist | grep -A 5 "com.apple.developer.associated-domains"
# Check: applinks:target.com

# Verify apple-app-site-association file
curl https://target.com/.well-known/apple-app-site-association

Step 2: Test Deep Link Injection

Android via ADB:

# Basic deep link invocation
adb shell am start -a android.intent.action.VIEW \
  -d "myapp://dashboard?user_id=1337" com.target.app

# Test with injection payloads
adb shell am start -a android.intent.action.VIEW \
  -d  com.target.app


adb shell am start -a android.intent.action.VIEW \
  -d  com.target.app


adb shell am start -a android.intent.action.VIEW \
  -d  com.target.app


adb shell am start -a android.intent.action.VIEW \
  -d  \
  --es extra_param  com.target.app