iOS Universal Links

Learn & practice AWS Hacking: Learn & practice GCP Hacking:

Support HackTricks

Check the !
Join the 💬 or the or follow us on Twitter 🐦 .
Share hacking tricks by submitting PRs to the and github repos.

Introduction

Universal links offer a seamless redirection experience to users by directly opening content in the app, bypassing the need for Safari redirection. These links are unique and secure, as they cannot be claimed by other apps. This is ensured by hosting a apple-app-site-association JSON file on the website's root directory, establishing a verifiable link between the website and the app. In cases where the app is not installed, Safari will take over and direct the user to the webpage, maintaining the app's presence.

For penetration testers, the apple-app-site-association file is of particular interest as it may reveal sensitive paths, potentially including ones related to unreleased features.

Analyzing the Associated Domains Entitlement

Developers enable Universal Links by configuring the Associated Domains in Xcode's Capabilities tab or by inspecting the .entitlements file. Each domain is prefixed with applinks:. For example, Telegram's configuration might appear as follows:

    <key>com.apple.developer.associated-domains</key>
    <array>
        <string>applinks:telegram.me</string>
        <string>applinks:t.me</string>
    </array>

For more comprehensive insights, refer to the .

If working with a compiled application, entitlements can be extracted as outlined in .

Retrieving the Apple App Site Association File

Handling Universal Links in the App

Validating the Data Handler Method

When a universal link opens an app, an NSUserActivity object is passed to the app with the URL. Before processing this URL, it's essential to validate and sanitize it to prevent security risks. Here's an example in Swift that demonstrates the process:

func application(_ application: UIApplication, continue userActivity: NSUserActivity,
                 restorationHandler: @escaping ([UIUserActivityRestoring]?) -> Void) -> Bool {
    // Check for web browsing activity and valid URL
    if userActivity.activityType == NSUserActivityTypeBrowsingWeb, let url = userActivity.webpageURL {
        application.open(url, options: [:], completionHandler: nil)
    }

    return true
}

URLs should be carefully parsed and validated, especially if they include parameters, to guard against potential spoofing or malformed data. The NSURLComponents API is useful for this purpose, as demonstrated below:

func application(_ application: UIApplication,
                 continue userActivity: NSUserActivity,
                 restorationHandler: @escaping ([Any]?) -> Void) -> Bool {
    guard userActivity.activityType == NSUserActivityTypeBrowsingWeb,
        let incomingURL = userActivity.webpageURL,
        let components = NSURLComponents(url: incomingURL, resolvingAgainstBaseURL: true),
        let path = components.path,
        let params = components.queryItems else {
        return false
    }

    if let albumName = params.first(where: { $0.name == "albumname" })?.value,
        let photoIndex = params.first(where: { $0.name == "index" })?.value {
        // Process the URL with album name and photo index

        return true

    } else {
        // Handle invalid or missing parameters

        return false
    }
}

Through diligent configuration and validation, developers can ensure that universal links enhance user experience while maintaining security and privacy standards.

Tools

References

Support HackTricks

PreviousiOS UIActivity Sharing NextiOS UIPasteboard

Last updated 7 months ago