Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1635.001_uri-hijacking
Adversaries may register Uniform Resource Identifiers (URIs) to intercept sensitive data.
Passed 19 of 22 test cases with the skill, and 12 of 22 without it.
and 6 more in the full report
7 fixed12 passed either way3 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 7 test cases the skill fixed. Same model, same prompt, with and without the skill.
We found that our mobile app relies on custom scheme URIs susceptible to interception on unmitigated devices. We need to log this finding in our enterprise risk register. Provide a risk assessment table specifying the exact finding title, severity, and impact.
| Checked | Without skill | With skill |
|---|---|---|
| Assigns High severity to the URI Hijacking applicable finding. | Passed | Passed |
| Categorizes impact as Credential Access. | Missed | Passed |
The instructions your model reads when the skill loads.
Sub-technique of: T1635
Adversaries may register Uniform Resource Identifiers (URIs) to intercept sensitive data.
Applications regularly register URIs with the operating system to act as a response handler for various actions, such as logging into an app using an external account via single sign-on. This allows redirections to that specific URI to be intercepted by the application. If an adversary were to register for a URI that was already in use by a genuine application, the adversary may be able to intercept data intended for the genuine application or perform a phishing attack against the genuine application. Intercepted data may include OAuth authorization codes or tokens that could be used by the adversary to gain access to protected resources.
Platforms: Android, iOS
Determine if the target mobile environment is susceptible to URI Hijacking by examining the target platforms (Android, iOS).
Review whether mitigations for T1635.001 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Developers should use Android App Links and iOS Universal Links to provide a secure binding between URIs and applications, preventing malicious applications from intercepting redirections. Additionally, for OAuth use cases, PKCE should be used to prevent use of stolen authorization codes.
test cases passed, vs 12 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.