android-intents-vulns

name	android-intents-vulns
description	Tests Android inter-process communication (IPC) through intents for vulnerabilities including intent injection, unauthorized component access, broadcast sniffing, pending intent hijacking, and content provider data leakage. Use when assessing Android app attack surface through exported components, testing intent-based data flows, or evaluating IPC security. Activates for requests involving Android intent security, IPC testing, exported component analysis, or Drozer assessment.
domain	cybersecurity
subdomain	mobile-security
author	mahipal
tags	["mobile-security","android","intents","ipc-security","owasp-mobile","penetration-testing"]
version	1.0.0
license	Apache-2.0
nist_csf	["PR.PS-01","PR.AA-05","ID.RA-01","DE.CM-09"]

Testing Android Intents for Vulnerabilities

When to Use

Use this skill when:

• Assessing Android app exported activities, services, receivers, and content providers
• Testing for intent injection and unauthorized component invocation
• Evaluating broadcast receiver security for sensitive data exposure
• Performing IPC-focused penetration testing on Android applications

Do not use on production devices without explicit authorization.

Prerequisites

• Rooted Android device or emulator with ADB
• Drozer agent installed on target device (drozer agent.apk)
• Drozer console on host (pip install drozer)
• Target APK decompiled with apktool for AndroidManifest.xml analysis
• Frida for runtime intent monitoring

Workflow

Step 1: Enumerate Exported Components

# Using Drozer
drozer console connect
run app.package.info -a com.target.app
run app.package.attacksurface com.target.app

# Output shows:
# X activities exported
# X broadcast receivers exported
# X content providers exported
# X services exported

# List exported activities
run app.activity.info -a com.target.app

# List exported services
run app.service.info -a com.target.app

# List exported receivers
run app.broadcast.info -a com.target.app

# List content providers
run app.provider.info -a com.target.app

Step 2: Test Exported Activities

# Launch exported activities directly
run app.activity.start --component com.target.app com.target.app.AdminActivity

# Launch with intent extras
run app.activity.start --component com.target.app com.target.app.ProfileActivity \
  --extra string user_id 1337

# Test intent injection via data URI
adb shell am start -a android.intent.action.VIEW \
  -d "content://com.target.app/users/admin" com.target.app

# If admin activity opens without auth, report as authorization bypass

Step 3: Test Broadcast Receivers

run app.broadcast.send --action com.target.app.PROCESS_PAYMENT \
  --extra string amount  --extra string recipient 


run app.broadcast.sniff --action com.target.app.USER_LOGIN


adb shell am broadcast -a com.target.app.RESET_PASSWORD \
  --es email