vulns.co
/
GKData.io MCP

Back to Playbooks

App Links and Universal Links

HTTPS app links are a verified host claim. Android uses assetlinks.json. Apple uses apple-app-site-association. A custom scheme is usually unverified. The bug is an auth callback that accepts the weaker claim.

Tags: mobile, applink, deeplink

Level: intermediate

Method

  1. Read the association files

    Fetch /.well-known/assetlinks.json and /.well-known/apple-app-site-association on hosts the app claims. Note package or team id and path prefixes.

    Tools: browser

  2. Compare with the installed app

    On a device or emulator you own, open one in-scope HTTPS link for a record you own. Record which app or browser handles it.

    Tools: browser

  3. Path scope

    A statement that claims every path on the host hands the whole origin to the app, including auth callbacks. Write down the path rule you actually saw.

    Tools: browser

  4. Custom schemes

    A scheme only the app registered is still claimable by any app on some platforms. If login finishes in that scheme, say whether a verified HTTPS link was also offered.

    Tools: browser

  5. Dangling hosts

    A host in the association file that does not exist, or that the company no longer controls, is a takeover-shaped lead. Confirm before you call it one. Do not register infrastructure.

    Tools: browser

  6. Stay on your device

    Do not send links to real users. The proof is your emulator and your account.

    Tools: browser

Field notes

  • Verified HTTPS links and custom schemes are different controls. Do not use one name for both.
  • The association file is public. Reading it is not an exploit.
  • Mobile scope is whatever the program listed. A public website host is not automatically the mobile app.

References