Android App Components Security Cheatsheet
Activities
Activities
What is it?
Activities define screens in an app. They can be exposed using android:exported="true"
or via intent-filters
.
What to Look For?
Exported Activities (
android:exported="true"
) that handle sensitive actions.Implicit Intents that allow external apps to launch activities.
Sensitive Data Handling via
getIntent().getExtras()
.Task Hijacking β Malicious apps inserting themselves into tasks.
How to Test?
Check for Exported Activities
Launch an Exported Activity via ADB
Send Malicious Data via Intent Injection
Task Hijacking (Launch in a new task)
Intents
Intents
What is it?
Intents allow communication between app components. Exported components handling unvalidated intents can be exploited.
What to Look For?
Exported Components (
android:exported="true"
) with intent-filters.Implicit Intents allowing unintended external access.
Unvalidated Intent Extras that may be exploited.
Search for intent-handling code e.g
Intent intent = getIntent()
.
How to Test?
Trigger an Intent via ADB
Send Data to an Activity
Broadcast an Intent
Services
Services
What is it?
Services run background tasks. Exported services can be triggered by external applications.
What to Look For?
Exported Services
<services
and (android:exported="true"
) inAndroidManifest.xml
.Sensitive Operations performed without authentication.
Binding to Services that lack proper permission checks.
How to Test?
List Running Services
Start a Service Manually
Send Data to a Service
Broadcast Receivers
Broadcast Receivers
What is it?
Broadcast Receivers handle system-wide and app-specific messages. If exported, they can be triggered by external sources.
What to Look For?
Exported Broadcast Receivers (
android:exported="true"
) inAndroidManifest.xml
.nReceive
method for sensitive data or actions.Dynamically Registered Receivers via
registerReceiver()
.
How to Test?
Send a Broadcast Message
Check for Broadcast Registration in Running App
Content Providers
Content Providers
What is it?
Content Providers manage access to structured data. If improperly secured, they may allow unauthorized access, SQL injection, or file traversal.
What to Look For?
Exported Content Providers (
android:exported="true"
) inAndroidManifest.xml
.Sensitive Data Queries exposed via content URIs.
Verify permissions, especially protectionLevel values (e.g., dangerous or signature).
SQL Injection Risks in
query()
,insert()
,update()
, anddelete()
.Identify Table Names Search for
content://
references in code to locate tables exposed via the ContentProvider
How to Test?
Check for Exported Content Providers
Query a Content Provider
Exploit SQL Injection
Attempt Path Traversal
WebView
WebView
What is it?
WebView is an Android component that renders web content inside apps. Poor configurations can lead to security vulnerabilities like XSS, token theft, and local file exfiltration.
What to Look For?
setJavaScriptEnabled(true)
β Allows JavaScript execution, leading to potential XSS.addJavascriptInterface(Object, "interface")
β Exposes native Android methods to JavaScript, enabling token theft or arbitrary code execution.setAllowFileAccess(true)
&setAllowUniversalAccessFromFileURLs(true)
β Grants WebView access to local files, allowing data exfiltration.setWebContentsDebuggingEnabled(true)
β Exposes WebView for debugging, making it easier for attackers to inspect app behavior.Loading URLs from
Intent
orUser Input
loadUrl()
β Allows attackers to inject malicious URLs.
How to Exploit?
Trigger WebView with Malicious URL via ADB:
Steal User Token using JavaScript Interface:
Local File Theft using
setAllowUniversalAccessFromFileURLs(true)
DeepLinks
DeepLinks
What is it?
Deep links allow apps to open specific activities via URLs (app://
, http://
). Misconfigured deep links can lead to security vulnerabilities..
How to Test?
Find Deep Links: Decompile APK & check
AndroidManifest.xml
for keywords like BROWSABLE and<dat
tag andExported="true"
Webview and check if javascript enabled .Exploit Commands
Last updated
Was this helpful?