Sign in to NBA ID

Continue watching games and highlights

PoC demo page — not the real NBA ID
Use of NBA ID constitutes acceptance of the Terms of Service.
If this were real, your credentials would now be on the attacker's server. Nothing was sent — the form is inert. Note there is no address bar: inside the app's webview you cannot tell this isn't nba.com.

The two vulnerable deep links

Vector 1 — Kochava smart link, no validation (verified on-device)
Vector 2 — gametime://webview allowlist bypass (redirect chain server-side verified; in-app render from static analysis)

What the NBA app just did

URL the webview requested (app-appended params highlighted)
amp_device_id (Amplitude device id) sent to this originnot present — opened from Safari?
OneTrust consent JS injected into this pagechecking…
Rendering context

Fingerprint

…

Page → app bridge (custom schemes are handed to UIApplication.openURL)

gametime://games gametime://watch gametime://signin?modal application/vnd.apple.pkpass → Wallet pass handler (signed ticket)
Wallet pass probe (/pass)Responses with the pkpass MIME type are intercepted by the webview's response policy (sub_1005C4EE4): the navigation is cancelled and the app downloads + processes the pass. The server serves a signed event-ticket pass (signed.pkpass, pass type pass.wang.jianing.test), so iOS offers the full "Add to Wallet" prompt from inside the NBA app. Without signed.pkpass the server generates an unsigned pass that hits the app's "Error processing PKPass:" path — which still proves the interception.
…