Challenges
Search…
Introduction
InsecureShop Challenges
Hardcoded Credentials
Insufficient URL Validation
Weak Host Validation
Arbitrary Code Execution
Intent Redirection (Access to Protected Components)
Unprotected Data URIs
Theft of Arbitrary files from LocalStorage
Using Components with Known Vulnerabilities
Insecure Broadcast Receiver
AWS Cognito Misconfiguration
Insecure use of FilePaths in FileProvider
Use of Implicit intent to send a broadcast with sensitive data
Intercepting Implicit intent to load arbitrary URL
Insecure Implementation of SetResult in exported Activity
Insecure Content Provider
Lack of SSL Certificate Validation
Insecure Webview Properties Enabled
Insecure Data Storage
Insecure Logging
Powered By GitBook
Insufficient URL Validation
The class com.insecureshop.WebViewActivity contains the following code. As per the code, the application registers a path web and a query parameter url.
android.net.Uri uri = intent.getData();
if (uri != null) {
android.net.Uri uri2 = uri;
java.lang.String str = null;
java.lang.String data = null;
if (kotlin.text.StringsKt.equals$default(uri.getPath(), "/web", false, 2, (java.lang.Object) null)) {
android.content.Intent intent2 = getIntent();
kotlin.jvm.internal.Intrinsics.checkExpressionValueIsNotNull(intent2, "intent");
android.net.Uri data2 = intent2.getData();
if (data2 != null) {
str = data2.getQueryParameter("url");
}
data = str;
​
The application does not implement URL validation which would allow remote users to load arbitrary content in webview by passing a deeplink or intent.
InsecureShop Challenges - Previous
Hardcoded Credentials
Next - InsecureShop Challenges
Weak Host Validation
Last modified 1yr ago
Copy link