App Links and Universal Links
HTTPS app links are a verified host claim. Android uses assetlinks.json. Apple uses apple-app-site-association. A custom scheme is usually unverified. The bug is an auth callback that accepts the weaker claim.
Tags: mobile, applink, deeplink
Level: intermediate
Method
Read the association files
Fetch /.well-known/assetlinks.json and /.well-known/apple-app-site-association on hosts the app claims. Note package or team id and path prefixes.
Tools: browser
Compare with the installed app
On a device or emulator you own, open one in-scope HTTPS link for a record you own. Record which app or browser handles it.
Tools: browser
Path scope
A statement that claims every path on the host hands the whole origin to the app, including auth callbacks. Write down the path rule you actually saw.
Tools: browser
Custom schemes
A scheme only the app registered is still claimable by any app on some platforms. If login finishes in that scheme, say whether a verified HTTPS link was also offered.
Tools: browser
Dangling hosts
A host in the association file that does not exist, or that the company no longer controls, is a takeover-shaped lead. Confirm before you call it one. Do not register infrastructure.
Tools: browser
Stay on your device
Do not send links to real users. The proof is your emulator and your account.
Tools: browser
Field notes
- Verified HTTPS links and custom schemes are different controls. Do not use one name for both.
- The association file is public. Reading it is not an exploit.
- Mobile scope is whatever the program listed. A public website host is not automatically the mobile app.