#!/usr/bin/env python3
"""Agent for testing deep link / custom URL scheme vulnerabilities in mobile apps."""

import argparse
import json
import re
import subprocess
from datetime import datetime, timezone


ANDROID_SCHEME_PATTERN = re.compile(
    r'<intent-filter[^>]*>.*?<data\s+android:scheme="([^"]+)".*?</intent-filter>',
    re.DOTALL
)
ANDROID_HOST_PATTERN = re.compile(r'android:host="([^"]+)"')

IOS_SCHEME_PATTERN = re.compile(r'<string>(\w+)</string>\s*</array>\s*<key>CFBundleURLName')
IOS_UNIVERSAL_PATTERN = re.compile(r'"applinks:\s*([\w.-]+)"')


def analyze_android_manifest(manifest_path):
    """Parse AndroidManifest.xml for deep link configurations."""
    findings = []
    try:
        with open(manifest_path, "r", errors="replace") as f:
            content = f.read()
    except FileNotFoundError:
        return findings

    for match in ANDROID_SCHEME_PATTERN.finditer(content):
        block = match.group(0)
        scheme = match.group(1)
        hosts = ANDROID_HOST_PATTERN.findall(block)
        exported = "android:exported=\"true\"" in block or "android:exported" not in block
        findings.append({
            "scheme": scheme,
            "hosts": hosts,
            "exported": exported,
            "block": block[:200],
            "risk": "HIGH" if exported and scheme not in ("https", "http") else "MEDIUM",
        })
    return findings


def analyze_ios_plist(plist_path):
    """Parse iOS Info.plist for URL scheme and universal link configurations."""
    findings = []
    try:
        with open(plist_path, "r", errors="replace") as f:
            content = f.read()
    except FileNotFoundError:
        return findings

    for match in IOS_SCHEME_PATTERN.finditer(content):
        findings.append({
            "type": "custom_url_scheme",
            "scheme": match.group(1),
            "risk": "HIGH",
            "note": "Custom URL schemes lack origin verification",
        })

    for match in IOS_UNIVERSAL_PATTERN.finditer(content):
        findings.append({
            "type": "universal_link",
            "domain": match.group(1),
            "risk": "LOW",
            "note": "Universal links verify domain ownership",
        })
    return findings


def test_deep_link_injection(scheme, host, path, payload):
    """Construct and test a deep link injection payload."""
    test_url = f"{scheme}://{host}{path}{payload}"
    return {
        "test_url": test_url,
        "payload": payload,
        "vectors": [
            "Open redirect via deep link",
            "JavaScript execution in WebView",
            "Parameter injection",
            "Intent redirection (Android)",
        ],
    }


def check_adb_deep_link(package, uri):
    """Test Android deep link via ADB."""
    cmd = ["adb", "shell", "am", "start", "-W",
           "-a", "android.intent.action.VIEW",
           "-d", uri, package]
    try:
        result = subprocess.check_output(cmd, text=True, errors="replace", timeout=15)
        return {"uri": uri, "status": "launched", "output": result[:300]}
    except (subprocess.SubprocessError, FileNotFoundError):
        return {"uri": uri, "status": "failed"}


def main():
    parser = argparse.ArgumentParser(
        description="Test deep link / URL scheme vulnerabilities (authorized testing only)"
    )
    parser.add_argument("--android-manifest", help="Path to AndroidManifest.xml")
    parser.add_argument("--ios-plist", help="Path to Info.plist")
    parser.add_argument("--test-scheme", help="URL scheme to test")
    parser.add_argument("--test-host", help="Host for deep link test")
    parser.add_argument("--output", "-o", help="Output JSON report")
    args = parser.parse_args()

    print("[*] Deep Link Vulnerability Testing Agent")
    report = {"timestamp": datetime.now(timezone.utc).isoformat(), "findings": []}

    if args.android_manifest:
        android = analyze_android_manifest(args.android_manifest)
        report["findings"].extend(android)
        print(f"[*] Android deep links found: {len(android)}")

    if args.ios_plist:
        ios = analyze_ios_plist(args.ios_plist)
        report["findings"].extend(ios)
        print(f"[*] iOS URL schemes found: {len(ios)}")

    if args.test_scheme and args.test_host:
        payloads = [
            "?redirect=https://evil.com",
            "#javascript:alert(1)",
            "?token=stolen&callback=https://evil.com",
            "/../../sensitive-path",
        ]
        for p in payloads:
            result = test_deep_link_injection(args.test_scheme, args.test_host, "/", p)
            report["findings"].append(result)

    report["risk_level"] = "HIGH" if report["findings"] else "LOW"

    if args.output:
        with open(args.output, "w") as f:
            json.dump(report, f, indent=2)
        print(f"[*] Report saved to {args.output}")
    else:
        print(json.dumps(report, indent=2))


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""
Deep Link Vulnerability Scanner

Extracts deep link definitions from AndroidManifest.xml and tests for common vulnerabilities.

Usage:
    python process.py --manifest AndroidManifest.xml [--package com.target.app] [--output report.json]
"""

import argparse
import json
import subprocess
import sys
import xml.etree.ElementTree as ET
from datetime import datetime
from pathlib import Path


def extract_deep_links(manifest_path: str) -> list:
    """Extract deep link definitions from AndroidManifest.xml."""
    tree = ET.parse(manifest_path)
    root = tree.getroot()
    ns = {"android": "http://schemas.android.com/apk/res/android"}

    deep_links = []

    for activity in root.findall(".//activity"):
        activity_name = activity.get(f"{{{ns['android']}}}name", "unknown")
        exported = activity.get(f"{{{ns['android']}}}exported", "false")

        for intent_filter in activity.findall("intent-filter"):
            actions = [a.get(f"{{{ns['android']}}}name", "") for a in intent_filter.findall("action")]
            categories = [c.get(f"{{{ns['android']}}}name", "") for c in intent_filter.findall("category")]

            if "android.intent.action.VIEW" not in actions:
                continue

            for data in intent_filter.findall("data"):
                scheme = data.get(f"{{{ns['android']}}}scheme", "")
                host = data.get(f"{{{ns['android']}}}host", "")
                path = data.get(f"{{{ns['android']}}}path", "")
                path_prefix = data.get(f"{{{ns['android']}}}pathPrefix", "")
                path_pattern = data.get(f"{{{ns['android']}}}pathPattern", "")

                if scheme:
                    deep_links.append({
                        "activity": activity_name,
                        "exported": exported,
                        "scheme": scheme,
                        "host": host,
                        "path": path or path_prefix or path_pattern or "/",
                        "browsable": "android.intent.category.BROWSABLE" in categories,
                        "url": f"{scheme}://{host}{path or path_prefix or path_pattern or '/'}",
                    })

    return deep_links


def assess_deep_link_security(deep_links: list) -> list:
    """Assess security of discovered deep links."""
    findings = []

    for link in deep_links:
        issues = []

        # Custom scheme (not https) - hijacking risk
        if link["scheme"] not in ("http", "https"):
            issues.append({
                "issue": "custom_scheme_hijackable",
                "severity": "HIGH",
                "description": f"Custom scheme '{link['scheme']}://' can be registered by any app",
            })

        # Exported activity without specific path
        if link["exported"] == "true" and link["path"] == "/":
            issues.append({
                "issue": "broad_path_matching",
                "severity": "MEDIUM",
                "description": "Activity matches all paths - wide attack surface",
            })

        # Browsable without verified links
        if link["browsable"] and link["scheme"] not in ("http", "https"):
            issues.append({
                "issue": "browsable_custom_scheme",
                "severity": "MEDIUM",
                "description": "Browsable intent with custom scheme invocable from web browsers",
            })

        if issues:
            findings.append({
                "deep_link": link["url"],
                "activity": link["activity"],
                "issues": issues,
            })

    return findings


def generate_test_commands(deep_links: list, package: str) -> list:
    """Generate ADB commands for testing deep links."""
    commands = []
    injection_payloads = [
        ("redirect_test", "?redirect=https://evil.com"),
        ("xss_test", "?q=<script>alert(1)</script>"),
        ("path_traversal", "/../../../etc/passwd"),
        ("sql_injection", "?id=1' OR '1'='1"),
    ]

    for link in deep_links:
        base_url = link["url"]

        # Basic invocation
        commands.append({
            "name": f"invoke_{link['activity']}",
            "command": f'adb shell am start -a android.intent.action.VIEW -d "{base_url}" {package}',
            "type": "basic",
        })

        # Injection tests
        for test_name, payload in injection_payloads:
            commands.append({
                "name": f"{test_name}_{link['activity']}",
                "command": f'adb shell am start -a android.intent.action.VIEW -d "{base_url}{payload}" {package}',
                "type": test_name,
            })

    return commands


def main():
    parser = argparse.ArgumentParser(description="Deep Link Vulnerability Scanner")
    parser.add_argument("--manifest", required=True, help="Path to AndroidManifest.xml")
    parser.add_argument("--package", default="com.target.app", help="Package name")
    parser.add_argument("--output", default="deeplink_report.json", help="Output report")
    args = parser.parse_args()

    if not Path(args.manifest).exists():
        print(f"[-] File not found: {args.manifest}")
        sys.exit(1)

    print("[*] Extracting deep links...")
    deep_links = extract_deep_links(args.manifest)
    print(f"[+] Found {len(deep_links)} deep link definitions")

    print("[*] Assessing security...")
    findings = assess_deep_link_security(deep_links)

    print("[*] Generating test commands...")
    commands = generate_test_commands(deep_links, args.package)

    report = {
        "scan": {
            "manifest": args.manifest,
            "package": args.package,
            "date": datetime.now().isoformat(),
        },
        "deep_links": deep_links,
        "findings": findings,
        "test_commands": commands,
        "summary": {
            "total_deep_links": len(deep_links),
            "total_findings": len(findings),
            "test_commands_generated": len(commands),
        },
    }

    with open(args.output, "w") as f:
        json.dump(report, f, indent=2)

    print(f"[+] Report saved: {args.output}")
    for f in findings:
        for issue in f["issues"]:
            print(f"    [{issue['severity']}] {f['deep_link']}: {issue['issue']}")


if __name__ == "__main__":
    main()