Box: Mobile — Deeplink + JWT Replay
box · medium · +110 XP
// what is Box: Mobile — Deeplink + JWT Replay?
Mobile deep-link abuse + JWT replay — apps register custom URL schemes (myapp://) so other apps and websites can launch them. If the app doesn't validate the incoming URL, an attacker can craft a malicious deep-link that triggers privileged actions (open an account-linking flow, exfiltrate session data, trigger an in-app browser to a phishing page). Combine with stale-token replay = takeover.
// how attackers detect it
- [01]Decompile the app (jadx / Hopper) and grep for
intent-filter,CFBundleURLSchemes. List all deep-link entry points. - [02]Send
intent://debug?dump=...,intent://launch?url=.... Many apps have leftover debug intents in production builds. - [03]Capture mobile traffic with
mitmproxy+ a local CA. Look at the auth flows for replayable tokens.
// how defenders prevent it
- ✓Verified app links (Android App Links / iOS Universal Links) tied to a signed
assetlinks.json— third-party browsers can't impersonate you. - ✓Validate every parameter from a deep-link as hostile user input. Strip / allow-list aggressively.
- ✓Bind JWTs to a
kidrotation policy. Oldkids become invalid after rotation, not 'still trusted just in case'.
// real-world incidents
CVE-2022-28282
Slack Android deep-link XSS
Local XSS via in-app browser via deep-link.
CVE-2020-3837
iOS WebKit deeplink memory bug
JIT bug triggerable from a crafted URL.
// hands-on tips for this lab
- ›Step 1:
GET /deeplink?url=intent://debug?dump=jwt→ leaks a stale JWT withkid=old-key-2021. Step 2: replay itAuthorization: Bearer <leaked>against/admin→ flag.
was this lesson helpful?