Thread by @AseemShrey

Android Hacking | Deeplink Issues | What, Why & How

➤ What, Why, How of Deeplink ?
➤ Hacking Deeplinks - Insecure URL Validation
➤ Finding, exploiting and fixing them
➤ Demo

#android #hacking #bugbounty #hackingsimplified
🧵👇

1. What's a Deeplink ?

In context of mobile apps, deeplinks are URLs that send users to a certain point in the app.

For example : If you click this :

fb://profile/100009566573630

It would open my facebook profile on your FB mobile app.

Hosted Link : bl.ocks.org/LuD1161/raw/1c…

2. Why are they used ?

Increase user engagement on the app.

e.g. Email Marketing
A company can have their deeplink URIs sent in emails and would want to redirect users into the app from there.

Detailed Read : clevertap.com/blog/5-reasons…

3. How do these work ?

Short answer : "AndroidManifest.xml"

Everything's in this file.
Intent filters are defined, they specify the URI scheme, host and even the path which an app can handle in their app.

e.g. For this app, a deeplink would be :
example.com/gizmos

4. Hacking Deeplinks - Insecure URL Validation

🚨Impact :

➤ Attacker is able to open a malicious link inside the app's WebView

5. Finding & Exploiting Insecure URL issues

6. How to fix these issues

➤ Stricter checks on URL validation

7. Demo

➤ Includes all of the above +
➤ Short summary about intent, intent-filters etc
➤ Practical Demo on insecureshopapp
➤ Facebook App, $8500 Report on the same

Thanks @0xgaurang for the awesome insecureshopapp.com