Reviewing WebViews, deep links and IPC
You audit the doors through which an app takes outside data: you find and fix mistakes in deep links, app links, WebView settings, JavaScript bridges, content providers and PendingIntents.
Level 301 · 22 lessons · 18 practice labs
Lessons
Deep links
- A deep link inventory: schemes, hosts, paths
- App links and assetlinks.json verification
- Parameter handling: unvalidated redirects and triggered actions
- Custom scheme collisions and OAuth redirect URIs
- Short task: map the deep links in a manifest and flag the unverified ones
WebView
- Auditing WebView settings: JavaScript, file access, mixed content
- Reviewing the JavaScript bridge: which methods are exposed
- URL loading checks and allowlist mistakes
- WebView data: cookies, local storage, cache
- Custom Tabs or WebView: the right choice for login flows
- Short task: audit the settings of four WebViews in an app and fix the risky one
Inter-component communication
- Reviewing exported activities: opening screens without authorisation
- Content provider review: path traversal, SQL and permission mistakes
- Broadcast receivers: unprotected and ordered broadcasts
- PendingIntent review: mutability and empty intents
- Short task: find a content provider's path check mistake and prove it with a test
Fixing and verifying
- The intent redirection mistake and safe forwarding
- Patterns for validating outside input
- Regression tests for IPC fixes
- Lint and semgrep rules that catch these mistakes
- Short task: fix an unvalidated redirect with an allowlist and write its test
Capstone
- Capstone: audit and fix the outside input surface of a shopping app
Practice labs
- Extract the deep link list from a manifest: Tabulate the scheme, host and path values.
- Find the unverified app links: Compare the assetlinks.json on the lab server with the manifest and show the domain missing verification.
- Report a custom scheme collision and the OAuth redirect risk: Show on the simulated device that two apps declare the same custom scheme and write advice to move to verified links.
- Find the code that reads a link parameter: List which parameters the deep link activity reads.
- Fix an unvalidated redirect with an allowlist: Fix code that opens the URL from a link directly, using a host allowlist, and write its test.
- Close a money transfer triggered by a link: Fix a link handler that starts a transaction without confirmation by adding session and user-confirmation checks, with tests for three bad inputs.
- List the WebViews in an app and their settings: Tabulate the JavaScript and file access settings for every WebView in the code.
- Fix a WebView that allows mixed content and file access: Turn off the risky settings and verify the configuration with a unit test.
- Find and fix a URL allowlist mistake: Show with a sample URL why code that checks the domain by string suffix can be bypassed and fix it with proper parsing.
- List the methods on the JavaScript bridge: Find the methods exposed to web pages in the bridge class.
- Remove a bridge method that reads files: Remove the bridge method that reads local files and replace the feature with a safe one.
- Move a login flow from WebView to Custom Tabs: Move a flow that collects the password in an in-app WebView to the system browser and show in code the bridge is no longer needed.
- Find the exported provider and its URIs: Extract the provider's authority and supported paths from the manifest and code.
- Prove a provider's path traversal flaw with a test: Show by test that a file-serving provider accepts input that climbs to a parent folder, and fix it.
- Protect an unprotected broadcast receiver with a permission: Limit a receiver that accepts broadcasts from anyone with a signature permission, update the sender too and test the behaviour.
- Find the intent redirection mistake in code: Find the line that directly launches an intent nested inside an incoming intent.
- Write a semgrep rule for mutable PendingIntents: Write the rule and test it with two positive and two negative samples.
- Audit the outside input surface of a shopping app: Extract link, WebView and provider findings in the Turnalı Perakende app, fix two and add regression tests.
About this course
You audit the doors through which an app takes outside data: you find and fix mistakes in deep links, app links, WebView settings, JavaScript bridges, content providers and PendingIntents.
What you will learn
- Deep links
- WebView
- Inter-component communication
- Fixing and verifying
- Capstone
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.