You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
When exported components expect specific extras, guessing payload shape causes time waste and false negatives. You can automate discovery of keys/types directly from Smali and emit ready-to-run adb commands.
- Approach: decompile and scan Smali for calls like `getStringExtra("key")`, `getIntExtra("id", ...)`, `getParcelableExtra("redirect_intent")`, `getSerializableExtra(...)`, `getBooleanExtra(...)`, `getAction()`, `getData()` to infer which extras and fields are consumed by each component.
70
+
- Output: for every exported Activity/Service/Receiver/Provider, the tool prints a short explanation and the exact `adb shell am ...`/`cmd content ...` command with correctly typed flags.
- URIs (extra): `--eu key content://...` | Data URI (Intent data): `-d content://...`
99
+
- Component extra: `--ecn key com.pkg/.Cls`
100
+
- Null string extra: `--esn key`
101
+
- Common flags: `-a <ACTION>``-c <CATEGORY>``-t <MIME>``-f <FLAGS>``--activity-clear-task --activity-new-task`
102
+
103
+
Pro tips for Providers
104
+
- Use `adb shell cmd content query|insert|update|delete ...` to hit ContentProviders without agents.
105
+
- For SQLi probing, vary `--projection` and `--where` (aka selection) when the underlying provider is SQLite-backed.
106
+
107
+
Full-pipeline automation (interactive executor)
108
+
```bash
109
+
# generate and capture commands then execute them one by one interactively
110
+
python apk-components-inspector.py app.apk | tee adbcommands.txt
111
+
python run_adb_commands.py
112
+
```
113
+
Helper script (merges continued lines, executes only lines starting with `adb`):
114
+
```python
115
+
import subprocess
116
+
117
+
defparse_adb_commands(file_path):
118
+
withopen(file_path, 'r') asfile:
119
+
lines =file.readlines()
120
+
commands = []
121
+
current = []
122
+
for line in lines:
123
+
s = line.strip()
124
+
if s.startswith("adb "):
125
+
current = [s]
126
+
elif s.startswith("#") ornot s:
127
+
if current:
128
+
full =''.join(current).replace("\\", "").replace("\\", "").strip()
129
+
commands.append(full)
130
+
current = []
131
+
elif current:
132
+
current.append(s)
133
+
if current:
134
+
full =''.join(current).replace("\\", "").replace("\\", "").strip()
135
+
commands.append(full)
136
+
return commands
137
+
138
+
for i, cmd inenumerate(parse_adb_commands('adbcommands.txt'), 1):
139
+
print(f"\nCommand {i}: {cmd}")
140
+
input("Press Enter to execute this command...")
141
+
try:
142
+
r = subprocess.run(cmd, shell=True, check=True, text=True, capture_output=True)
143
+
print("Output:\n", r.stdout)
144
+
if r.stderr:
145
+
print("Errors:\n", r.stderr)
146
+
except subprocess.CalledProcessError as e:
147
+
print(f"Command failed with error:\n{e.stderr}")
148
+
```
149
+
Run on-device: the inspector is Python-based and works in Termux or rooted phones where `apktool`/`androguard` are available.
150
+
151
+
---
152
+
153
+
## Intent Redirection (CWE-926) – finding and exploiting
154
+
155
+
Pattern
156
+
- An exported entry point (Activity/Service/Receiver) reads an incoming Intent and forwards it internally or externally without validating source/data, e.g.:
157
+
-`startActivity(getIntent())`
158
+
-`startActivity(intent)` where `intent` came from an extra like `redirect_intent`/`next_intent`/`pending_intent` or `Intent.parseUri(...)`.
159
+
- Trusting `action`/`data`/`component` fields without checks; not verifying caller identity.
160
+
161
+
What to search in Smali/Java
162
+
- Uses of `getParcelableExtra("redirect_intent")`, `getParcelable("intent")`, `getIntent().getParcelableExtra(...)`.
163
+
- Direct `startActivity(...)`, `startService(...)`, `sendBroadcast(...)` on attacker-influenced Intents.
164
+
- Lack of `getCallingPackage()`/`getCallingActivity()` checks or custom permission gates.
165
+
166
+
ADB PoC templates
167
+
- Proxy Activity forwarding an extra Intent to a privileged internal Activity:
-[Automating Android App Component Testing with New APK Inspector (blog)](https://www.mobile-hacker.com/2025/09/18/automating-android-app-component-testing-with-new-apk-inspector/)
0 commit comments