| name | exploiting-deeplink-vulnerabilities |
| description | Tests and exploits deep link (URL scheme and App Link) vulnerabilities in Android and iOS mobile applications to identify unauthorized access, data injection, intent hijacking, and redirect manipulation. Use when assessing mobile app attack surface through custom URI schemes, Android App Links, iOS Universal Links, or intent-based navigation. Activates for requests involving deep link security testing, URL scheme exploitation, mobile intent abuse, or link hijacking.
|
| domain | cybersecurity |
| subdomain | mobile-security |
| author | mahipal |
| tags | ["mobile-security","android","ios","deep-links","owasp-mobile","penetration-testing"] |
| version | 1.0.0 |
| license | Apache-2.0 |
| nist_csf | ["PR.PS-01","PR.AA-05","ID.RA-01","DE.CM-09"] |
Exploiting Deep Link Vulnerabilities
When to Use
Use this skill when:
- Assessing mobile app deep link handling for injection and redirect vulnerabilities
- Testing Android intent filters and iOS URL scheme handlers for unauthorized access
- Evaluating App Links (Android) and Universal Links (iOS) verification
- Testing for link hijacking via competing app registrations
Do not use without authorization -- deep link exploitation can trigger unintended actions in target applications.
Most Often Missed & How to Confirm
- App Links / Universal Links verification state — testers assume links are hijackable. Confirm with
adb shell pm get-app-links <pkg> (status verified = safe) and by fetching /.well-known/assetlinks.json or apple-app-site-association.
- WebView
javascript: and file:// loading — skipped when only query params are fuzzed. Confirm by launching myapp://open?url=file:///data/data/<pkg>/... and observing a local file read.
- Unauthenticated vs authenticated state — testing only while logged in hides auth-bypass deep links. Confirm by invoking the link before login and checking the protected screen loads.
- Fragment vs query handling — apps parse
# differently than ?. Confirm by sending the same payload in both positions.
- Encoding-bypassed filters — confirm by URL-encoding the payload and re-checking that the sink still fires.
- Intent extras injection — confirm with
--es/--ez extras that override server-trusted values (amount, recipient, role).
Prerequisites
- Android device with ADB or iOS device with Objection/Frida
- APK decompiled with apktool or JADX for AndroidManifest.xml analysis
- Knowledge of target app's registered URL schemes and intent filters
- Drozer for Android intent testing
- Burp Suite for intercepting deep link-triggered API calls
Workflow
Step 1: Enumerate Deep Link Entry Points
Android - Extract from AndroidManifest.xml:
apktool d target.apk -o decompiled/
grep -A 10 decompiled/AndroidManifest.xml
