id: deep-link-custom-scheme-detect

info:
  name: Android Deep Link - Detect Custom Schemes
  author: 7h3b4dger
  severity: info
  description: Detects custom URI schemes (non-http/https) declared in Deep Link intent filters.
  tags: android,file,deeplink

file:
  - extensions:
      - xml

    matchers:
      - type: xpath
        part: body
        xpath:
          - "//activity/intent-filter/action[@android:name='android.intent.action.VIEW']"
          - "//activity/intent-filter/category[@android:name='android.intent.category.BROWSABLE']"
        condition: and

    extractors:
      - type: xpath
        part: body
        attribute: android:scheme
        xpath:
          - "/manifest/application/activity/intent-filter/data[@android:scheme!='http' and @android:scheme!='https']"
# digest: 4b0a00483046022100dfee623cb783925f2b89ea83c79151915f4162f43ea65bbefc3f722abef572bd022100b858c523655c14169534615ca34ad18ccdae8f6e8f6bdae088ada1b8c25ec943:922c64590222798bb761d5b6d8e72950