Resources

People often ask me "How did you learn how to hack?" The answer: by reading. This page is a collection of the blog posts and other articles that I have accumulated over the years of my journey. Enjoy!

Shazam has deeplink functionality for its mobile application for both Android and iOS. One part of this functionality allowed loading a website into a webview, within the application.

However, the URL parameter, specified for the deeplink, was not being validated. This meant that either website can be put into the webview, or using a JavaScript URI. The webview included some JS interfaces that allowed for polling of specific data on the device.

In particular, physical location data could be tracked by someone who loaded a malicious site inside of the webview.

The attack flow was pretty cool. A user clicks on a deeplink URI which opens the Shazam application. Once the application is open, the webview with the malicious site is used. The malicious site can then extract the GPS information about the user!

This is a ever interesting use of deeplinks in exploitation. In the future, I'll keep this a little more on my radar.