| name | testing-android-intents-for-vulnerabilities |
| description | Tests Android inter-process communication (IPC) through intents for vulnerabilities including intent injection, unauthorized component access, broadcast sniffing, pending intent hijacking, and content provider data leakage. Use when assessing Android app attack surface through exported components, testing intent-based data flows, or evaluating IPC security. Activates for requests involving Android intent security, IPC testing, exported component analysis, or Drozer assessment.
|
| domain | cybersecurity |
| subdomain | mobile-security |
| author | mahipal |
| tags | ["mobile-security","android","intents","ipc-security","owasp-mobile","penetration-testing"] |
| version | 1.0.0 |
| license | Apache-2.0 |
| nist_csf | ["PR.PS-01","PR.AA-05","ID.RA-01","DE.CM-09"] |
Testing Android Intents for Vulnerabilities
When to Use
Use this skill when:
- Assessing Android app exported activities, services, receivers, and content providers
- Testing for intent injection and unauthorized component invocation
- Evaluating broadcast receiver security for sensitive data exposure
- Performing IPC-focused penetration testing on Android applications
Do not use on production devices without explicit authorization.
Most Often Missed & How to Confirm
exported default by SDK level — a component with no android:exported is exported below API 31, private at 31+. Confirm the effective state against targetSdkVersion, not the manifest alone.- Permission-guarded exported components — confirm by invoking with and without the required permission; only the unprotected case is a finding.
- Mutable PendingIntents — confirm by hooking
PendingIntent.getActivity and checking for FLAG_MUTABLE (0x02000000) without FLAG_IMMUTABLE.
- Content provider SQLi / traversal — confirm with
scanner.provider.injection/traversal and a UNION SELECT proving data extraction.
- Broadcast data leakage — confirm by sniffing an exported action with
app.broadcast.sniff and capturing sensitive extras.
- Implicit vs explicit intents — confirm only implicit (action-based) components are reachable by other apps before reporting.
Prerequisites
- Rooted Android device or emulator with ADB
- Drozer agent installed on target device (
drozer agent.apk)
- Drozer console on host (
pip install drozer)
- Target APK decompiled with apktool for AndroidManifest.xml analysis
- Frida for runtime intent monitoring
Workflow
Step 1: Enumerate Exported Components
drozer console connect
run app.package.info -a com.target.app
run app.package.attacksurface com.target.app
run app.activity.info -a com.target.app
run app.service.info -a com.target.app
run app.broadcast.info -a com.target.app
run app.provider.info -a com.target.app
