Menu
Android vulnerability hunting and exploitation — APK analysis, native exploits, IPC bugs
Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.
Baseado na classificação ocupacional SOC
Next-generation 0day discovery & exploit development — comprehensive code analysis, allocator vulnerabilities, compiler-induced bugs, SIMD/vector issues, JIT vulnerabilities, custom allocator attacks, ASLR/kASLR bypass, UAF, OOB, RCE with exploit generation, privilege escalation, backdoor establishment
Next-generation 0day discovery — novel overflow patterns, allocator exploits, compiler-induced bugs, bounds-check bypass, SIMD/vector overflows, JIT vulns, custom allocator attacks, ASLR/kASLR bypass, UAF, OOB, RCE with weaponized exploit generation, privilege escalation, backdoor establishment
Container escape vulnerability discovery — Docker, Kubernetes, container runtime exploitation, namespace isolation bypass, privilege escalation through container boundaries
Crypto implementation analysis — weak algorithms, side-channels, key management flaws, padding oracles, random generation failures, implementation bugs
IoT device security analysis — firmware extraction, RTOS exploits, hardware interfaces, protocol vulnerabilities, side-channel attacks, update mechanism exploitation
Industrial control system security — Modbus, DNP3, IEC 104, Ethernet/IP, PLC exploitation, control logic manipulation, sensor/actuator attacks, ICS protocol analysis
| name | Android Exploit |
| description | Android vulnerability hunting and exploitation — APK analysis, native exploits, IPC bugs |
| tags | ["android","apk","exploit","mobile","dalvik","native"] |
Task: Android Vulnerability Hunting and Exploitation. Analyze APKs, find vulnerabilities, develop exploits.
Android security analysis requires: APK reverse engineering, Dalvik bytecode analysis, native code exploitation, IPC vulnerability hunting.
APK Decompilation
Tools:
- apktool: Decode APK resources and smali code
- jadx: Decompile DEX to Java
- dex2jar: Convert DEX to JAR
- JD-GUI: View Java code
Analysis:
1. Extract APK: unzip app.apk
2. Decode resources: apktool d app.apk
3. Decompile code: jadx app.apk
4. Analyze manifest: AndroidManifest.xml
5. Review permissions: declared permissions
Manifest Analysis
AndroidManifest.xml checks:
- Exported components (exported="true")
- Permission requirements
- Custom permissions
- Backup configuration
- Debuggable flag
- Network security config
Key findings:
- android:exported="true" (exposes to other apps)
- android:debuggable="true" (debuggable app)
- android:allowBackup="true" (data leak)
- Custom permissions (over-privileged)
Component Analysis
Activities:
- Launchable activities (intent filters)
- Exported activities (access control)
- Deep link handling (URL exploitation)
Services:
- Exported services (IPC attack surface)
- Intent handling (malicious intents)
- Background services (data access)
Receivers:
- Broadcast receivers (system events)
- Ordered broadcasts (denial-of-service)
- Intent injection vulnerabilities
Providers:
- Content providers (data access)
- SQL injection (query parameters)
- Path traversal (URI manipulation)
Smali Code Review
Patterns to find:
1. Hardcoded secrets (API keys, passwords)
2. Insecure crypto (ECB mode, weak keys)
3. SQL injection (concatenated queries)
4. XSS (webview JavaScript)
5. Command injection (Runtime.exec)
Search in smali:
- const-string (hardcoded strings)
- invoke-virtual (crypto operations)
- invoke-static (SQL operations)
- invoke-direct (command execution)
Runtime Analysis
Dynamic instrumentation:
- Frida: Hook and modify app behavior
- Xposed: System-wide modification
- MobSF: Automated security testing
Key hooks:
- SharedPreferences (data storage)
- SQLiteDatabase (SQL queries)
- WebView.loadUrl (XSS)
- Runtime.exec (command injection)
- Encryption operations (key extraction)
Native Library Analysis
Target: .so files in lib/ARM/, lib/x86/
Analysis:
1. Extract: unzip app.apk lib/*.so
2. Disassemble: Ghidra/IDA Pro
3. Find: JNI functions (Java_*)
4. Look for: Dangerous operations
Vulnerabilities:
- Buffer overflows in JNI
- Memory corruption in native code
- Insecure crypto implementations
- Hardcoded keys in native code
- Weak random number generation
JNI Exploitation
JNI vulnerability patterns:
1. Java → Native boundary checks
2. Buffer handling in native code
3. Array bounds checking
4. String handling (strcpy, sprintf)
Exploit development:
1. Identify vulnerable JNI function
2. Craft malicious Java input
3. Trigger buffer overflow
4. Control PC/SP registers
5. Bypass ASLR/DEP (ROP chains)
6. Execute shellcode
Native Memory Corruption
Targets:
- libnative.so (custom native code)
- OpenSSL integration
- SQLite native code
- Media codec libraries
Techniques:
- Stack overflow in JNI handlers
- Heap overflow in native allocations
- Use-after-free in native objects
- Integer overflow in size calculations
Exploitation:
1. Trigger vulnerability from Java
2. Control native code execution
3. Bypass sandbox (native code)
4. Gain code execution
Intent Spoofing
Attack: Malicious app sends crafted intent
Targets:
- Exported activities (component hijacking)
- Exported services (service hijacking)
- Broadcast receivers (intent injection)
Example:
Intent intent = new Intent();
intent.setClassName("com.victim.app", "com.victim.app.VulnActivity");
intent.putExtra("key", malicious_data);
startActivity(intent); // Trigger vulnerability
PendingIntent Hijacking
Vulnerability: PendingIntent with implicit intent
Attack:
1. Malicious app creates hijacking component
2. Victim app creates PendingIntent with implicit intent
3. Attacker triggers PendingIntent
4. Hijacking component receives intent
5. Access to victim app's permissions
Detection:
- Search for: PendingIntent.getIntent()
- Check: Intent is explicit or implicit
- Exploit: Create hijacking component
Content Provider SQL Injection
Vulnerability: Uns sanitized SQL query
Example:
Cursor cursor = getContentResolver().query(
Uri.parse("content://com.victim.provider/data"),
null,
"name = '" + userInput + "'", // ← SQLi!
null,
null
);
Attack:
1. Malicious app queries content provider
2. Inject SQL: ' OR '1'='1
3. Extract sensitive data
4. Modify database content
AIDL Interface Exploitation
Attack: Malicious app binds to AIDL service
Targets:
- Exposed AIDL interfaces
- Custom IPC protocols
- Bundle parameter handling
Exploitation:
1. Bind to vulnerable service
2. Call malicious methods
3. Pass crafted bundles
4. Trigger vulnerabilities
5. Access protected data
WebView Vulnerabilities
XSS in WebView:
- addJavascriptInterface (exposes Java methods)
- loadUrl with user input (XSS)
- file:// access (local file disclosure)
- debuggable WebView (remote inspection)
Exploitation:
1. Inject JavaScript into WebView
2. Call exposed Java methods
3. Access local files (file://)
4. Extract sensitive data
5. Execute arbitrary code
CVE-2012-6636:
addJavascriptInterface in Android < 4.2
→ Full code execution via JavaScript
Insecure Data Storage
Vulnerabilities:
- SharedPreferences world-readable
- SQLite database world-readable
- External storage (SD card) usage
- Hardcoded encryption keys
- Weak encryption algorithms
Attack:
1. Access app's data directory
2. Read SharedPreferences
3. Extract SQLite databases
4. Decrypt sensitive data
5. Extract credentials
Tools:
- adb shell
- sqlite3
- Key extraction
- Custom decryption scripts
Certificate Pinning Bypass
Target: Apps with certificate pinning
Bypass methods:
1. Frida script: Hook SSL verification
2. Xposed module: Disable pinning
3. Modify APK: Remove pinning code
4. Custom CA: Install malicious certificate
Frida script:
Java.perform(function() {
var TrustManager = Java.use("javax.net.ssl.TrustManager");
TrustManager.checkServerTrusted.implementation = function() {
// Bypass certificate validation
};
});
Permission Bypass
Attack: Access protected features without permissions
Techniques:
1. Intent redirection (use other app's permissions)
2. Content provider confusion
3. Service hijacking
4. PendingIntent hijacking
Example:
- Victim app has READ_CONTACTS permission
- Attacker app has no permissions
- Attacker triggers victim app via Intent
- Victim app performs action on attacker's behalf
- Attacker gains indirect access to contacts
Access Control Issues
Vulnerabilities:
- Missing permission checks
- Weak permission checks (signature vs normal)
- UID confusion (shared UID)
- Exported components without protection
Exploitation:
1. Identify exported components
2. Check permission requirements
3. Test with malicious app
4. Bypass access controls
5. Access protected functionality
Kernel Vulnerabilities
Targets:
- Binder IPC (CVE-2019-2215, CVE-2020-0014)
- ION memory allocator (CVE-2020-0041)
- Media frameworks (CVE-2019-2025, CVE-2020-0022)
- Bluetooth stack (CVE-2020-0022)
Exploitation:
1. Trigger kernel vulnerability from app
2. Gain kernel code execution
3. Disable SELinux
4. Root device
5. Install persistent backdoor
SELinux Bypass
Goal: Disable SELinux enforcement
Methods:
1. Kernel exploit → Disable SELinux
2. Modify policy files (requires root)
3. Exploit SELinux policy bugs
4. Use permissive domains
Impact:
- Full system compromise
- Persistent root access
- Bypass all security mechanisms
APK Exploit POC
1. Create malicious APK
2. Declare minimal permissions
3. Exploit target app
4. Extract data / execute code
5. Demonstrate impact
Example:
<manifest>
<uses-permission android:name="android.permission.INTERNET"/>
</manifest>
public class ExploitActivity extends Activity {
@Override
protected void onCreate(Bundle savedInstanceState) {
super.onCreate(savedInstanceState);
// Exploit vulnerable content provider
Uri uri = Uri.parse("content://com.vulnerability.provider/data");
Cursor cursor = getContentResolver().query(uri, null,
"' OR '1'='1", null, null); // SQLi
}
}
Native Exploit POC
1. Identify vulnerable JNI function
2. Craft overflow payload
3. Build ROP chain
4. Bypass ASLR/DEP
5. Execute shellcode
Example (CVE-2020-0022):
// Bluetooth stack heap overflow
byte[] payload = new byte[1000];
Arrays.fill(payload, (byte)0x41); // Padding
payload[800] = (byte)0x00; // PC overwrite
// Send via Bluetooth L2CAP
socket.send(payload);
Emulator Testing
Tools:
- Android Studio Emulator
- Genymotion
- Android-x86
Setup:
1. Create AVD with vulnerable Android version
2. Install target APK
3. Install exploit APK
4. Test vulnerability
5. Verify exploit works
Device Testing
Physical devices:
1. Enable developer options
2. Enable USB debugging
3. Install APKs via adb
4. Test exploits
5. Monitor logs (adb logcat)
Considerations:
- Device-specific vulnerabilities
- Android version differences
- OEM customizations
- Kernel version variations
[VULNERABILITY] Android SQL Injection
App: com.victim.app (v2.3.1)
Severity: HIGH (data extraction)
CVE: N/A (0-day)
[Bug Details]
Component: ContentProvider (com.victim.provider.DataProvider)
Vulnerability: SQL injection in query() method
Location: DataProvider.java:142
Code: selection = "user_id = '" + userInput + "'"
[Exploitation]
1. Malicious app queries provider
2. Inject: "' OR '1'='1"
3. Extract all user data
4. Access: emails, passwords, tokens
[POC APK]
Package: com.exploit.sqlite
Min SDK: 21
Permissions: None (exploits victim's permissions)
Intent:
Intent intent = new Intent();
intent.setClassName("com.victim.app", "com.victim.app.DataProvider");
String query = "content://com.victim.provider/data?user=' OR '1'='1";
Cursor cursor = getContentResolver().query(Uri.parse(query), null, null, null, null);
Impact:
- Extract 50,000 user records
- Access authentication tokens
- Bypass access controls
- No permissions required
Fix: Use parameterized queries