App components and intents: activity, service, receiver, provider
You learn the four components that make up an Android app, intents and deep links, and how to protect that surface.
Level 201 · 22 lessons · 18 practice labs
Lessons
The four components
- Activities and their lifecycle
- Services: foreground, background and bound
- Broadcast receivers: system and app broadcasts
- Content providers: sharing data by URI
- Short task: build a component inventory from a manifest
Intents
- Explicit and implicit intents
- Intent filters and the exported attribute
- PendingIntent and mutability flags
- Deep links and verified app links
- Validating data that arrives in an intent
- Short task: work out which component receives an intent sent with am
Protecting components
- The risk of exported components and protecting them with permissions
- Provider permissions, temporary URI grants and FileProvider
- The task stack, launchMode and taskAffinity
- WebView: the JavaScript bridge and file access
- Short task: close three needlessly exported components and re-check the manifest
Inspecting components from the command line
- Reading an app's components with dumpsys package
- Working out who answers an intent with pm and cmd
- Manifest merging: components added by libraries
- exported defaults: the rules across versions
- Short task: find the exported component a library added in the merged manifest
Capstone
- Capstone: map and harden an app's component and intent surface
Practice labs
- Build a component inventory from a manifest: List every component in a manifest by type.
- List exported components with their guarding permissions: Tabulate the exported components of Göktaşı Yazılım's app and the permission guarding each.
- Track how the component surface changed over three versions: Compare the manifests of three versions of one app and report the newly exported components per version.
- Find which component answers an intent: Resolve on the simulated device which activity an intent with the given action and data reaches.
- Find several apps answering the same intent: List every app able to handle a payment link and flag the unexpected receiver.
- Find sensitive data sent with an implicit intent: Find session data sent by implicit intent in the source and fix it with an explicit intent.
- Close a needlessly exported activity: Find the settings screen left exported in the manifest and correct its exported value.
- Protect an exported service with a signature permission: Protect a service shared between two company apps with a signature-level permission and re-check the manifest.
- Close three components and write a regression check: Close three needlessly exported components and add a check script that tests the number of exported components at build time.
- Read a provider's permission settings: Find a content provider's read and write permissions and exported value in the manifest.
- Narrow a FileProvider path definition: Reduce a FileProvider paths file that shares the whole file area to just the needed subfolder.
- Audit the use of temporary URI grants: Find where URI permissions are granted in the source, fix the one granted too widely and document why.
- Read the PendingIntent flags: List whether the PendingIntents created in the source are mutable or immutable.
- Fix a mutable PendingIntent: Make safe a mutable PendingIntent with an empty intent used in a notification.
- Audit deep link filters together with verification: Extract the deep link filters from the manifest and report those that are not verified app links and paths that are too broad.
- Read an app's components with dumpsys: Extract an app's receivers and filters from dumpsys package output on the simulated device.
- Find the exported component that came from a library: Compare the merged manifest with the source manifest and show the exported component a library added.
- Remove or close a library's component in the manifest: Use merge rules to remove a needless library component, rebuild and confirm the result.
About this course
You learn the four components that make up an Android app, intents and deep links, and how to protect that surface.
What you will learn
- The four components
- Intents
- Protecting components
- Inspecting components from the command line
- Capstone
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.