Trendyol Live — deeplink proof of concept

Caches the Trendyol Live scripts. A user who has opened Trendyol Live before is already in this state.

Attacker JavaScript runs on live.trendyol.com and prints the WebView cookie jar — including token= — into the page.

Prints the raw query string the page received. Screenshot it and count the %25 chain before 2B — that is how many times this device decoded the link, which identifies the correct depth below. Works on any device.

Same origin, same sink — this time the token leaves the device as an image request. Watch wrangler tail.

How many times your browser decodes the link before handing it to the app varies by browser, so there is one button per depth. Tap them in order and stop at the first one that works — the log prints which depth succeeded. If a button shows Trendyol's "Beklenmedik bir hata" page, that depth is wrong; just go back and tap the next one.