From a “Hey, {name} 👋” Banner to Full Account Takeover Chain...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://medium.com/@bag0zathev2/from-a-hey-name-banner-to-full-account-takeover-chaining-4-bugs-through-a-rewards-webview-f89a2b0f830f
• Blog Title: From a “Hey, {name} 👋” Banner to Full Account Takeover: Chaining Four Bugs Through a Rewards WebView
• Suggested Section: Mobile Pentesting > Android Applications Pentesting > Webview Attacks; cross-reference Intent Injection/custom schemes and Pentesting Web > XSS/IDOR

🎯 Content Summary

Overview and security impact

The post describes a chain of four independent vulnerabilities in an Android application's loyalty/rewards feature. The feature is implemented as a client-side web application loaded in an in-app WebView:

https://rewards.redacted.com/lp/index.html?token=<capability_token>

The page communicates directly with a third-party customer-engagement/CRM service:

POST https://crm.redacted.com/bulk

By ch...

🔧 Technical Details

Public identifier used as authorization: When a client-facing analytics, CRM, or marketing API identifies users with a value such as hard_id, test whether replacing that value permits access to another user's records. Search for identifiers in referral links, API responses, analytics requests, mobile resources, and page source. If profile writes succeed without a session, signature, or authorization header, the identifier is functioning as an insecure bearer credential. Such a primitive can be used not only for profile tampering, but also to inject data into downstream templates, support interfaces, emails, or WebViews.

Converting arbitrary profile writes into stored XSS: Trace every attacker-writable profile property into HTML-generating features such as banners, CRM campaigns, dashboards, previews, and notification templates. JSON escaping is not HTML output encoding: after the JSON parser reconstructs the string, characters suc...

🤖 Agent Actions

Updated src/mobile-pentesting/android-app-pentesting/webview-attacks.md.

Added:

• trusted-origin CRM/banner HTML as a stored-XSS-to-WebView-bridge pivot
• callback wrapping to steal credential-returning bridge results like JWTs
• warnings that scheme-only loadUrl() validation and getReferrer() / Intent.EXTRA_REFERRER are not auth controls
• intent:// browser-trigger example
• WebView-origin exfil validation tips (; wv, X-Requested-With, Referer)

Also updated the file’s ## References with:

• the provided blog post
• Android official docs for Activity.getReferrer() and Intent.EXTRA_REFERRER

Verification:

• only this single file was modified
• ## References remains at the end of the file before the closing banner include

Note:

• mdbook build could not be run because mdbook is not installed in this environment.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://medium.com/@bag0zathev2/from-a-hey-name-banner-to-full-account-takeover-chaining-4-bugs-through-a-rewards-webview-f89a2b0f830f

Content Categories: Based on the analysis, this content was categorized under "Mobile Pentesting > Android Applications Pentesting > Webview Attacks; cross-reference Intent Injection/custom schemes and Pentesting Web > XSS/IDOR".

Repository Maintenance:

• MD Files Formatting: 990 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0