5. Browsable Intent attack

  1. Methods to find a bug

Rough Note : 

1. To trigger deeplink we use browsable
2. Manifest -> Browsable trigger app using link
3. search for exported=true or intent filter in manifestfile
4. search for browsable 
5. check for deeplink
6. go to activity
7. check for method accept data from intent like oncreate(), onResume() etc
8. search for loadurl() using intent function
9. conform it load activity using browsable intent

Steps :-
		1) Open jadx and open the application
		2) Now open androisManifest.xml file
		3) Search for "android.intent.category.BROWSABLE"
		4) Check for deep links (android:scheme,android:host)
		5) Check these methods wether its accepting any data from intent ( onCreate() , onResume() , onRestart() , onBackpress() and more )
		6) Now search for loadUrl();
		7) Now check the loadUrl() accepting any data direct from intent
		8) if yes then its exploitable : )

	Sample vulnerable code :-

		package name :- com.example.mobile

		AndroidManifest.xml :-

			 <activity android:name="com.example.mobile.MainActivity" >
           			 <intent-filter>
               				 <action android:name="android.intent.action.VIEW"/>
               				 <category android:name="android.intent.category.DEFAULT"/>
               				 <category android:name="android.intent.category.BROWSABLE"/>
               				 <data android:scheme="example"/>
					 <data android:scheme="example" android:host="auth.example.com">
					 <data android:scheme="example" android:host="auth.example.com" android:pathPrefix="/android/">
           			 </intent-filter>
			 </activity>

		Activity.java :-

				 public void onCreate(Bundle bundle)
					{
					        Intent data = new Intent();
						String url  = data.getDataString();
						WebView w = (WebView) findViewById(R.id.web);
						w.loadUrl(url);
					}

url = https://www.google.com/index.html

scheme = https
host = google.com
path = /

  1. PoC 1

  1. PoC 2

Previous4. Insecure Web viewNext6. Exported Activity

Last updated