search

optiv / InsecureShop

An Intentionally designed Vulnerable Android Application built in Kotlin.
https://www.insecureshopapp.com
MIT License
229 stars 150 forks source link

Unprotected Data URIs #2

Open marvyr opened 2 years ago

marvyr commented 2 years ago

Does the extra mile included there actually work any more ?

If yes, what is the correct intent that should be used. As far as i checked and searched it should no longer work.

This is the result i am getting:

09-16 22:29:26.838 13798 13798 I chromium: [INFO:CONSOLE(0)] "Navigation is blocked: intent:#Intent;action=ACTION_VIEW;type=text/plain;component=com.insecureshop/com.insecureshop.WebView2Activity;S.url=http://someurl.com;end", source: http://myawesomesite.com/ (0)

Where from http://myawesomesite.com/ i tried with javascript, or with a button.

<a href="intent://#Intent;action=ACTION_VIEW;type=text/plain;component=com.insecureshop/com.insecureshop.WebView2Activity;S.url=http://someurl.com;end">Trigger</a>
hax0rgb commented 2 years ago

Hey @marvyr

Try the following intent URI:

intent://www.google.com#Intent;scheme=https;action=com.insecureshop.action.WEBVIEW;component=com.insecureshop/.WebView2Activity;end

I tried this a few months ago and found that the intent URI scheme did not work on Chrome, but it did work on Firefox.

marvyr commented 2 years ago

@0xgaurang thank you for your answer, tried chrome, opera and firefox but none of them worked