Mobile Vulnerability Classes: Hunter Knowledge Base

This skill defines all vulnerability classes that MobHunt hunter agents check for. Each class includes: what to look for, how to verify, impact assessment, and whether it stands alone or requires chaining.

OWASP Mobile Top 10 (2024) Mapping

iOS Vulnerability Classes

IOS-01: URL Scheme Hijacking

• What: Custom URL scheme (CFBundleURLTypes) that can be registered by a malicious app
• Where: Info.plist → CFBundleURLTypes
• Check: Is the scheme used for OAuth callbacks, deep linking with sensitive params, or token passing?
• Verify: Can a second app register the same scheme and intercept the data?
• Impact: Token theft, authentication bypass, data interception
• Standalone: YES, if the scheme carries sensitive data (OAuth tokens, session IDs)
• CVSS: 6.1–8.1 depending on data sensitivity
• Test: xcrun simctl openurl booted 'schemename://callback?token=test'

IOS-02: Universal Link Misconfiguration

• What: Missing or improperly configured Apple-App-Site-Association (AASA) file
• Where: Entitlements → com.apple.developer.associated-domains
• Check: Fetch https://<domain>/.well-known/apple-app-site-association. Does it exist? Is the app ID correct?
• Verify: Does the AASA file match the app's bundle ID and team ID?
• Impact: Link hijacking, phishing, credential theft
• Standalone: YES, if the link carries auth data
• CVSS: 5.4–7.5

IOS-03: App Transport Security Bypass

• What: ATS globally disabled or per-domain exceptions allowing HTTP
• Where: Info.plist → NSAppTransportSecurity
• Check: NSAllowsArbitraryLoads = true, per-domain exceptions with NSExceptionAllowsInsecureHTTPLoads
• Verify: Does the app actually send sensitive data over these HTTP connections?
• Impact: MITM, credential interception, data theft
• Standalone: CHAIN REQUIRED; ATS bypass alone is informational. Must demonstrate sensitive data sent over HTTP.
• CVSS: 3.7 alone, 7.5+ when chained with MITM

IOS-04: Keychain Weak Protection

• What: Keychain items stored with weak accessibility levels
• Where: Binary → kSecAttrAccessible* constants
• Check: kSecAttrAccessibleAlways or AfterFirstUnlock for tokens/passwords
• Verify: Can the data be extracted from a locked device or backup?
• Impact: Credential theft from device backup or locked device
• Standalone: CHAIN REQUIRED; must demonstrate extraction path
• CVSS: 4.0–5.5

IOS-05: Pasteboard Data Exposure

• What: Sensitive data written to UIPasteboard.general
• Where: Binary → UIPasteboard, generalPasteboard
• Check: What data is placed on the pasteboard? Is it PII, tokens, passwords?
• Verify: Can another app read the pasteboard while the target app is backgrounded?
• Impact: Data theft by malicious app
• Standalone: YES on iOS < 16, CHAIN REQUIRED on iOS 16+ (paste notification)
• CVSS: 4.3–6.5

IOS-06: Excessive Entitlements

• What: App has dangerous entitlements that shouldn't be in App Store builds
• Where: Embedded entitlements (via codesign)
• Check: get-task-allow, com.apple.private.*, disable-library-validation
• Verify: Is this actually a production App Store build? (TestFlight builds have get-task-allow)
• Impact: Allows debugging, code injection, sandbox escape
• Standalone: YES, if confirmed production build
• CVSS: 7.0–9.0

IOS-07: WebView JavaScript Bridge Abuse

• What: WKScriptMessageHandler or JSContext exposing native functions to web content
• Where: Binary → WKScriptMessageHandler, userContentController:didReceiveScriptMessage:
• Check: What native functions are exposed? Do they validate the web origin?
• Verify: Can a deep link or redirect load attacker-controlled content in the WebView?
• Impact: Native code execution, data access, privilege escalation
• Standalone: YES, if attacker can control loaded URL
• CVSS: 6.1–9.8
• Priority chain target: This class is a key component in PRIORITY-01 (deeplink → bridge → misconfigured WebView) and PRIORITY-02 (deeplink → router bypass → authenticated WebView). When found, always cross-reference with IOS-01/02 deep link entry points. Also check: does the WebView hold session cookies (WKHTTPCookieStore)? Does it have allowFileAccessFromFileURLs enabled? Does the deep link router validate URL schemes (block javascript:, file://)?

IOS-08: Insecure Data Storage

• What: Sensitive data in UserDefaults, plist files, or unencrypted databases
• Where: Binary → NSUserDefaults, standardUserDefaults, sqlite3_open
• Check: What data types are stored? PII? Tokens? Credentials?
• Verify: Can data be extracted via backup or file system access?
• Impact: Credential/data theft
• Standalone: CHAIN REQUIRED; must demonstrate extraction method
• CVSS: 3.3–5.5

IOS-09: Hardcoded Secrets

• What: API keys, tokens, credentials embedded in the binary
• Where: Binary strings, embedded resources
• Check: Which service does the key belong to, and what does that provider document this key type as granting?
• Verify: Exercise the key against the service only when the service is a listed in-scope asset, and, when it is third-party hosted (Firebase, Google Cloud, AWS, and similar), only with the program's written permission. Without both, stop at static evidence: record where the key lives, what it is documented to unlock, and ask the program to confirm server side.
• Impact: Unauthorized API access, data breach, financial loss
• Standalone: YES, if the key grants meaningful access
• CVSS: 5.0–9.1 depending on key permissions

Android Vulnerability Classes

AND-01: Exported Component Abuse

• What: Activity/Service/Receiver/Provider with exported=true and no permission protection
• Where: AndroidManifest.xml
• Check: Can the component be invoked by any app? What does it do?
• Verify: adb shell am start -n <package>/<component>; does it work from any app?
• Impact: Unauthorized access, data theft, privilege escalation
• Standalone: YES, if the component exposes data or actions
• CVSS: 5.0–8.0
• Test: adb shell am start -n <package>/<activity>

AND-02: Content Provider SQL Injection

• What: Content provider query() builds SQL from URI parameters without parameterization
• Where: Java source → ContentProvider.query(), rawQuery()
• Check: Is the selection parameter or URI path used directly in SQL?
• Verify: adb shell content query --uri content://<authority>/<table> --where "1=1 OR 1=1--"
• Impact: Database dump, data modification, authentication bypass
• Standalone: YES
• CVSS: 7.5–9.1

AND-03: Intent Redirection

• What: Activity reads a Parcelable Intent from incoming intent and forwards it
• Where: Java source → getParcelableExtra("intent"), startActivity(extractedIntent)
• Check: Does the code validate the extracted intent's target component?
• Verify: Send a crafted intent that redirects to a non-exported component
• Impact: Access to non-exported components, privilege escalation
• Standalone: YES
• CVSS: 7.7

AND-04: Deep Link Hijacking

• What: Custom scheme deep link without android:autoVerify="true" (App Links)
• Where: AndroidManifest.xml → <intent-filter> with <data android:scheme="...">
• Check: Is the scheme custom (not http/https)? Is autoVerify missing?
• Verify: Register the same scheme in a malicious app; who gets the intent?
• Impact: Data interception, phishing, OAuth token theft
• Standalone: YES, if the deep link carries sensitive data
• CVSS: 6.1–8.1

AND-05: WebView JavaScript Interface RCE

• What: addJavascriptInterface exposes Java methods to web content
• Where: Java source → webView.addJavascriptInterface(object, "name")
• Check: What methods have @JavascriptInterface? Can attacker control loaded URL?
• Verify: Load attacker-controlled URL → call exposed methods via JavaScript
• Impact: Code execution, data access, file system access
• Standalone: YES, if attacker controls loaded URL
• CVSS: 8.8–9.8
• Priority chain target: Key component in PRIORITY-01 chains. When found, always cross-reference with AND-04 deep link entry points. Trace whether any deep link handler can load a URL into this WebView. Also check for javascript: scheme injection; if the router does not block javascript: URLs, an attacker can call @JavascriptInterface methods directly via a deep link like myapp://open?url=javascript:AndroidBridge.sensitiveMethod().

AND-06: WebView File Access

• What: setAllowFileAccessFromFileURLs(true) or setAllowUniversalAccessFromFileURLs(true)
• Where: Java source → WebSettings configuration
• Check: Combined with JS enabled? Can attacker load a file:// URL?
• Verify: Load file:///data/data/<package>/shared_prefs/*.xml via XSS
• Impact: Local file read, credential theft
• Standalone: YES, if combined with loadUrl from untrusted source
• CVSS: 7.5–8.8
• Priority chain target: Key component in PRIORITY-01 chains. When file access is enabled, check: can a deep link (AND-04) inject a file:// URL through the router? Even without explicit file access settings, setAllowUniversalAccessFromFileURLs(true) lets any loaded page read local files via XHR, and combined with an attacker-controlled URL in the WebView, this is full local file exfiltration.

AND-07: Insecure Broadcast

• What: Sensitive data sent via broadcast without receiver permission
• Where: Java source → sendBroadcast(intent) without permission parameter
• Check: What data is in the broadcast intent? Is it sensitive?
• Verify: Register a receiver for the broadcast action; do you receive the data?
• Impact: Data interception, session hijacking
• Standalone: YES, if broadcast contains sensitive data
• CVSS: 5.5–7.5

AND-08: Backup Data Extraction

• What: android:allowBackup="true" combined with sensitive data in app storage
• Where: AndroidManifest.xml + app data directories
• Check: What data is stored? SharedPrefs with tokens? SQLite with credentials?
• Verify: adb backup -f backup.ab <package> → extract → check contents
• Impact: Credential theft, session hijacking
• Standalone: CHAIN REQUIRED; allowBackup alone is not a finding
• CVSS: 4.0–5.5

AND-09: PendingIntent Hijacking

• What: Mutable PendingIntent with implicit base intent
• Where: Java source → PendingIntent.getActivity/Service/Broadcast without FLAG_IMMUTABLE
• Check: Is the base intent implicit? Can attacker's app intercept and modify it?
• Verify: On API < 31, PendingIntent defaults to mutable
• Impact: Unauthorized actions performed under the app's identity
• Standalone: YES, on API < 31
• CVSS: 6.5–7.7

AND-10: Hardcoded Secrets

• What: API keys, credentials, tokens in Java source, resources, or native libs
• Where: Decompiled source, strings.xml, assets/, .so files
• Check: Which service does the key belong to, and what does that provider document this key type as granting?
• Verify: Make API calls with the key only when the service is a listed in-scope asset, and, when it is third-party hosted, only with the program's written permission. Otherwise document the key statically and ask the program to confirm whether it is live.
• Impact: Unauthorized API access, data breach
• Standalone: YES, if key grants access
• CVSS: 5.0–9.1

Cross-Platform Vulnerability Classes

XP-01: Hardcoded Secrets (General)

See IOS-09 and AND-10 above. Applies to both platforms.

XP-02: Certificate Pinning Weakness

• What: Missing or bypassable certificate pinning
• Where: Binary/source → TrustKit, OkHttp CertificatePinner, network security config pins
• Check: Is pinning implemented? Can it be bypassed (debug flag, fallback to system trust)?
• Standalone: NO; missing pinning alone is informational. Must chain with MITM demonstration.
• CVSS: 3.7 alone

XP-03: Weak Cryptography

• What: MD5, DES, 3DES, RC4, ECB mode, hardcoded keys/IVs
• Where: Binary → crypto function calls; Source → Cipher.getInstance(), MessageDigest
• Check: Is the weak crypto used for security-critical operations (not just checksums)?
• Verify: Identify what data is protected and demonstrate the weakness
• Standalone: YES, if protecting authentication or sensitive data
• CVSS: 5.9–7.5

XP-04: Third-Party SDK Vulnerability

• What: Embedded SDK with known CVE applicable to the installed version
• Where: Framework bundles (iOS), package directories (Android)
• Check: Extract exact SDK version, match against CVE database
• Verify: Is the vulnerable code path reachable in this app's integration?
• Standalone: YES, if CVE is applicable to the embedded version
• CVSS: Inherits from the CVE

XP-05: OAuth/Token Handling Flaw

• What: Insecure token storage, missing PKCE, improper redirect URI validation
• Where: Binary strings → OAuth endpoints; Source → OAuth implementation
• Check: Where are tokens stored? Is PKCE used? Are redirect URIs validated?
• Standalone: YES, if tokens are exposed or auth can be bypassed
• CVSS: 6.5–8.8

XP-06: Insecure Local Database

• What: Unencrypted SQLite/Realm/Core Data with PII or credentials
• Where: Binary → sqlite3_open, Realm; Source → SQLiteOpenHelper, Room
• Check: Is encryption (SQLCipher, Realm encryption) applied?
• Verify: Extract database file, check for sensitive contents
• Standalone: CHAIN REQUIRED; must demonstrate extraction path
• CVSS: 3.3–5.5

Never-Submit List (Auto-KILL)

These findings are automatically killed unless chained to a higher-impact vulnerability:

1. Missing certificate pinning alone
2. android:allowBackup="true" alone
3. android:debuggable="true" on production (report as note, not vuln)
4. Missing root/jailbreak detection alone
5. Cleartext traffic configuration alone (ATS exception / cleartextTrafficPermitted)
6. Missing ASLR/PIE/stack canaries on modern OS (enforced by platform)
7. Self-signed certificates in app bundle (often intentional for pinning)
8. Analytics SDK data collection (privacy, not security)
9. Clipboard access on iOS 16+ (system paste notification mitigates)
10. Missing obfuscation (informational, not a vulnerability)