iOS Custom URI Handlers / Deeplinks / Custom Schemes

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

Hii ni muhtasari kutoka kwa taarifa zinazohusiana na https://mas.owasp.org/MASTG/tests/ios/MASVS-PLATFORM/MASTG-TEST-0075/

Taarifa za Msingi

Mipango ya URL ya kawaida inaruhusu programu kuwasiliana kwa kutumia itifaki maalum, kama ilivyoelezwa katika Apple Developer Documentation. Mipango hii lazima itangazwe na programu, ambayo kisha inashughulikia URL zinazokuja kufuata mipango hiyo. Ni muhimu kuhakiki vigezo vyote vya URL na kukatisha URL zozote zisizo sahihi ili kuzuia mashambulizi kupitia njia hii.

Mfano unatolewa ambapo URI myapp://hostname?data=123876123 inachochea kitendo maalum cha programu. Uthibitisho wa udhaifu ulionekana katika programu ya Skype Mobile, ambayo iliruhusu vitendo vya simu visivyo ruhusiwa kupitia itifaki ya skype://. Mipango iliyosajiliwa inaweza kupatikana katika Info.plist ya programu chini ya CFBundleURLTypes. Programu mbaya zinaweza kutumia hii kwa kujiandikisha tena URIs ili kukamata taarifa nyeti.

Usajili wa Mipango ya Maswali ya Programu

Kuanzia iOS 9.0, ili kuangalia kama programu inapatikana, canOpenURL: inahitaji kutangaza mipango ya URL katika Info.plist chini ya LSApplicationQueriesSchemes. Hii inakadiria mipango ambayo programu inaweza kuuliza kuwa 50, ikiongeza faragha kwa kuzuia orodha ya programu.

<key>LSApplicationQueriesSchemes</key>
<array>
<string>url_scheme1</string>
<string>url_scheme2</string>
</array>

Testing URL Handling and Validation

Wakandarasi wanapaswa kuchunguza mbinu maalum katika msimbo wa chanzo ili kuelewa ujenzi wa njia za URL na uthibitishaji, kama vile application:didFinishLaunchingWithOptions: na application:openURL:options:. Kwa mfano, Telegram inatumia mbinu mbalimbali za kufungua URL:

func application(_ application: UIApplication, open url: URL, sourceApplication: String?) -> Bool {
self.openUrl(url: url)
return true
}

func application(_ application: UIApplication, open url: URL, sourceApplication: String?,
annotation: Any) -> Bool {
self.openUrl(url: url)
return true
}

func application(_ app: UIApplication, open url: URL,
options: [UIApplicationOpenURLOptionsKey : Any] = [:]) -> Bool {
self.openUrl(url: url)
return true
}

func application(_ application: UIApplication, handleOpen url: URL) -> Bool {
self.openUrl(url: url)
return true
}

Testing URL Requests to Other Apps

Mbinu kama openURL:options:completionHandler: ni muhimu kwa kufungua URL ili kuingiliana na programu nyingine. Kutambua matumizi ya mbinu kama hizo katika msimbo wa chanzo wa programu ni muhimu kwa kuelewa mawasiliano ya nje.

Testing for Deprecated Methods

Mbinu zilizopitwa na wakati zinazoshughulikia ufunguzi wa URL, kama application:handleOpenURL: na openURL:, zinapaswa kutambuliwa na kupitia kwa athari za usalama.

Fuzzing URL Schemes

Fuzzing URL schemes inaweza kutambua makosa ya ufisadi wa kumbukumbu. Zana kama Frida zinaweza kuendesha mchakato huu kwa kufungua URL zenye mzigo tofauti ili kufuatilia ajali, kama inavyoonyeshwa na udanganyifu wa URL katika programu ya iGoat-Swift:

$ frida -U SpringBoard -l ios-url-scheme-fuzzing.js
[iPhone::SpringBoard]-> fuzz("iGoat", "iGoat://?contactNumber={0}&message={0}")
Watching for crashes from iGoat...
No logs were moved.
Opened URL: iGoat://?contactNumber=0&message=0

References

• https://mas.owasp.org/MASTG/tests/ios/MASVS-PLATFORM/MASTG-TEST-0075/

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Angalia mpango wa usajili!

• Jiunge na 💬 kikundi cha Discord au kikundi cha telegram au tufuatilie kwenye Twitter 🐦 @hacktricks_live.

• Shiriki mbinu za hacking kwa kuwasilisha PRs kwa HackTricks na HackTricks Cloud repos za github.