Link to this headingApplication Components

• Activity: Point of user interaction with the application, most commonly through a UI screen or window
• Broadcast Receiver: Listens for and receives messages from
  applications and the Android system
• Content Provider: Application data storage (SQLite databases)
• Service: Operates in the background to provide long-running
  application functionality without user interaction

Parameters: Look for putExtra(key, value), get*Extra(key) or getData() to see what parameters are taken from a Android Intent. Look for getQueryParameter for parameters names.

Link to this headingActivities

These Activities must be declared in the Manifest file. These are the UI views that can be shown to the user. The start funciton of the app is a Activity that can be called by any application. This is how a homescreen opens the app when the icon is pressed.

Activity Lifecycle:

• onCreate(): When the Activity Starts this function is called.

• onStart(): When the Activity Starts this function is called after onCreate(). This is run when the activity is shown to the user.

• onResume(): This is called when the Activity is foregrounded after onStart(). This is also called when the app is running but switches from another Activity.

• onPause(): This is run when the Application starts another activity, switches to another application, when receiving a phone call, or the device screen’s turning off.

• onStop(): This occurs when the a new activity covers the entire screen or when the activity has finished running.

• onDestroy(): This occurs after the onStop callback.

android:exported

• If set to true this Activity be launched by another application.
• If this has an intent-filter in it then it is exported by default
• If set to false can only be launched by components of the same application or the same user ID. This is the default value.
• Look for getString

Link to this headingSecurity

Get Activity information from a Application:

Launch an Activity with Drozer:

Start an Activity from the commandline:

Finding an Activity in Code:

• startActivity()
• getExtras()

Link to this headingLaunch Activity PoC

Link to this headingFragments

These are partial UI views similar to Activities but don’t need to be declared in the Manifest File.

FLAG_SECURE: On an fragment prevents information from being shown on the application switcher.

Link to this headingBroadcast/Intent Receiver

• Enable applications to receive messages/triggers that are broadcast by the system or by other applications,
  • This can happen when the application is not running.
  • Example getting a text message, incoming call, or a notification
• Can be created in the Manifest file or by Code.
• This information is not secret since it can be listened to by other applications on the device

android:exported

• If set to true this Receiver can receive intents from other applications. This is the default value if their are intent filters.
• If set to false can only be launched by components of the same application or the same user ID. This is the default value if their are no intent filters.

Link to this headingSecurity

List Broadcast Receiver in a Application:

Sending a Broadcast from the commandline:

Sending a Broadcast from Drozer:

Link to this headingCode Review

• Check AndroidManifest for <intent-filter> this limits what the service is subscribed to.
• Check the onReceive function to see what is pulled from the context and the Intent.

Checking in Code:

• BroadcastReceiver
• onReceive
• IntentFilter
• .addAction
• registerReciever

Link to this headingServices

• Must be declared in the Manifest file.
• Is a background task that can be run when not in the foreground.
• Is started using Intents

Viewing Android Services:

android:exported

• If set to true this Activity be launched by another application. This is the default value if their are intent filters.
• If set to false can only be launched by components of the same application or the same user ID. This is the default value if their are no intent filters.

android:permission

• specifies if the caller needs a specific permission to launch the service. By default the service is not protected by a permission.

Link to this headingSecurity

List all services from an application:

Start a Service from Commandline:

Start a Service from Drozer:

Link to this headingStart Service PoC

Link to this headingContent Providers

• Usually connected to a database

Can be viewed from content://com.example.app.provider/table1/1 or content://com.example.app.provider/table2/*

Read from the Provider:

Write to the Provider:

Check to see if there is a Permission to Read and Write the Provider. If not then any application can read and write these values.

Link to this headingSecurity

Detect SQL injections in content providers:

Checking in Code:

• Grep for ContentProvider
• Grep for onReceive

Link to this headingFile Provider

A file provider allows other application to access specific files and folders.

To view a file from this Provider try content://com.example.myapp.fileprovider/myimages/default_image.jpg