Deep Link Fuzzer

EXECUTION

Phase 1 — Reconnaissance

Android:

• Grep: intent-filter.*BROWSABLE|android:scheme|android:host|android:pathPrefix in AndroidManifest.xml
• Grep: getIntent\(\)|intent\.data|intent\.getStringExtra — intent data handling
• Grep: Uri\.parse|intent\.extras — deep link parameter extraction
• Check assetlinks.json: Glob **/.well-known/assetlinks.json — App Links verification

iOS:

• Glob **/*.plist for LSApplicationQueriesSchemes, CFBundleURLTypes
• Grep: application.*openURL|scene.*openURL|continueUserActivity — URL handling
• Grep: url\.scheme|url\.host|url\.queryItems — URL parsing
• Check apple-app-site-association: Glob **/.well-known/apple-app-site-association

Phase 2 — Analysis

CRITICAL:

• Custom URL scheme (not Universal Links / App Links) used for OAuth callbacks — scheme hijacking possible
• Deep link handler loads URL directly into WebView without validation — javascript: injection

HIGH:

• Deep link parameters passed to navigation without validation — open redirect
• Deep link bypasses authentication — unauthenticated deep link navigates to authenticated content
• No assetlinks.json or apple-app-site-association — Universal Links / App Links not verified

MEDIUM:

• Deep link parameters used in SQL/API queries without sanitization
• Exported Activity / BroadcastReceiver that handles deep links — any app can send intents

Phase 3 — Remediation (90%)

Safe deep link handling (Android Kotlin):

// In Activity.onCreate() or fragment handler
fun handleDeepLink(intent: Intent) {
    val uri = intent.data ?: return

    // 1. Validate scheme and host against allowlist
    val allowedHosts = setOf("app.yourdomain.com", "yourdomain.com")
    if (uri.scheme != "https" || uri.host !in allowedHosts) {
        Log.w("DeepLink", "Rejected deep link with invalid host: ${uri.host}")
        return
    }

    // 2. Extract and validate path
    val path = uri.path ?: return
    val allowedPaths = setOf("/invite/", "/reset-password/", "/verify-email/")
    if (allowedPaths.none { path.startsWith(it) }) {
        Log.w("DeepLink", "Rejected deep link with unexpected path: $path")
        return
    }

    // 3. Extract parameters safely — never use raw URI in navigation
    val token = uri.getQueryParameter("token")
    if (token.isNullOrEmpty() || !token.matches(Regex("[a-zA-Z0-9_-]{20,128}"))) {
        showError("Invalid link")
        return
    }

    // 4. Route to appropriate screen with validated token
    navigateToScreen(path, token)
}

iOS Swift deep link handler:

func handleDeepLink(_ url: URL) {
    // 1. Validate scheme and host
    guard url.scheme == "https",
          let host = url.host,
          host.hasSuffix(".yourdomain.com") else {
        return  // Reject silently
    }

    // 2. Parse and validate components
    let components = URLComponents(url: url, resolvingAgainstBaseURL: false)
    let path = url.path

    // 3. Route based on allowlisted paths
    switch path {
    case _ where path.hasPrefix("/invite/"):
        guard let token = components?.queryItems?.first(where: { $0.name == "token" })?.value,
              token.range(of: #"^[a-zA-Z0-9_-]{20,128}$"#, options: .regularExpression) != nil else {
            return
        }
        handleInviteToken(token)

    case _ where path.hasPrefix("/verify-email/"):
        // Handle email verification
        break

    default:
        return  // Unknown path — reject
    }
}

assetlinks.json — verify App Links (Android):

[{
  "relation": ["delegate_permission/common.handle_all_urls"],
  "target": {
    "namespace": "android_app",
    "package_name": "com.yourcompany.app",
    "sha256_cert_fingerprints": ["AA:BB:CC:..."]
  }
}]

apple-app-site-association — verify Universal Links (iOS):

{
  "applinks": {
    "apps": [],
    "details": [{
      "appID": "TEAMID.com.yourcompany.app",
      "paths": ["/invite/*", "/reset-password/*", "/verify-email/*"]
    }]
  }
}

Phase 4 — Verification

• Test: send deep link with javascript:alert(1) as path → should be rejected
• Test: send deep link with ../../../sensitive as path → should not navigate
• Verify: App Links / Universal Links are associated: curl https://yourdomain.com/.well-known/assetlinks.json

COMPLIANCE MAPPING

{
  "complianceImpact": {
    "pciDss": ["Req 6.2.4"],
    "soc2": ["CC6.1"],
    "nist80053": ["SI-10"],
    "iso27001": ["A.14.2.5"],
    "owasp": ["M4:2024"]
  }
}

OUTPUT FORMAT

AgentFinding[] array. Each finding must include:

• id: SCREAMING_SNAKE_CASE (e.g. DEEP_LINK_NO_HOST_VALIDATION, DEEP_LINK_CUSTOM_SCHEME_OAUTH, DEEP_LINK_WEBVIEW_INJECTION)
• title: one-line description
• severity: CRITICAL | HIGH | MEDIUM | LOW
• cwe: CWE-601 (URL Redirection to Untrusted Site), CWE-20 (Improper Input Validation)
• attackTechnique: MITRE ATT&CK T1406 (Adversary-in-the-Middle — Mobile)
• files: deep link handler paths
• evidence: specific unvalidated parameter handling
• remediated: true if validation was written inline
• remediationSummary: what was implemented
• requiredActions: ordered action list
• complianceImpact: framework mappings
• beyondSkillMd: true if finding goes beyond the SKILL.md mandate