Port MASTG-TEST-0026: Testing Implicit Intents (android) (by @appknox) #3271

ScreaMy7 · 2025-05-16T11:41:29Z

ScreaMy7 · 2025-05-16T18:00:45Z

@cpholguera Please review. This format is slightly different, so please let me know the changes that are needed.

TheDauntless

Hi @ScreaMy7 ! Thanks for contributing!

This PR is mixing up two different things though. Implicit intents are an issue because they can be intercepted by other applications, thereby possible intercepting sensitive information. While the explanation seems to be correct, the demo itself doesn't show the vulnerability. Can you please update the code to showcase the vulnerability?

ScreaMy7 · 2025-06-17T07:13:11Z

@TheDauntless Thanks for the review. Have you tried the dynamic demo, which has an attacker application to trigger the intent redirect to the internal parts of the vulnerable application? Could you please explain more about the mix-up?

TheDauntless · 2025-06-18T12:21:13Z

@ScreaMy7

Either the explanation of the test is wrong, or the implementation.

This test is about implicit intent interception so the demo would be:

The vulnerable app has an intent-filter on a non exported activity (currently not the case)
The attacker app has the same intent filter (currently not the case)
The vulnerable app launches its vulnerable activity with an implicit intent and pass some sensitive data (currently not the case)

Result: The user can choose between the legitimate app and the attacker app, and the sensitive data would leak if they choose the attacker app

Your demo describes the attacker intercepting data, but data isn't intercepted anywhere? You're just triggering an implicit activity with an explicit intent; all the data stays inside of the vulnerableapp. Where is the attack? What you are describing is something that Android fixes itself in Android 15: https://developer.android.com/about/versions/15/behavior-changes-15#safer-intents

ScreaMy7 · 2025-07-04T09:01:06Z

Hi @TheDauntless ,
I have updated the demo, please review it.

Copilot

Pull Request Overview

This PR ports the deprecated MASTG-TEST-0026 (Testing Implicit Intents) to MASTG V2 format by creating two new tests that cover different aspects of implicit intent vulnerabilities. The change maintains backward compatibility by marking the original test as deprecated while providing comprehensive coverage through static and dynamic analysis approaches.

Deprecates MASTG-TEST-0026 and creates MASTG-TEST-0287 (static analysis) and MASTG-TEST-0286 (dynamic analysis)
Adds comprehensive demonstration files showing both vulnerable code patterns and exploitation techniques
Includes Semgrep rule for automated detection of exported activities with custom intent filters

Reviewed Changes

Copilot reviewed 15 out of 15 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
tests/android/MASVS-CODE/MASTG-TEST-0026.md	Marks original test as deprecated with references to new tests
tests-beta/android/MASVS-CODE/MASTG-TEST-0287.md	New static analysis test for implicit intent vulnerabilities
tests-beta/android/MASVS-CODE/MASTG-TEST-0286.md	New dynamic analysis test for implicit intent interception
rules/mastg-android-custom-intent-intecept.yml	Semgrep rule for detecting vulnerable intent filter configurations
demos/android/MASVS-CODE/MASTG-DEMO-0059/	Static analysis demonstration with Semgrep output
demos/android/MASVS-CODE/MASTG-DEMO-0058/	Dynamic analysis demonstration with vulnerable and attacker code

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

Copilot · 2025-08-31T18:31:04Z

tests-beta/android/MASVS-CODE/MASTG-TEST-0286.md

@@ -0,0 +1,28 @@
+---
+title: Implicit intent to intecept internal app components


There's a typo in the title: 'intecept' should be 'intercept'.

Suggested change

title: Implicit intent to intecept internal app components

title: Implicit intent to intercept internal app components

Copilot · 2025-08-31T18:31:05Z

demos/android/MASVS-CODE/MASTG-DEMO-0059/run.sh

@@ -0,0 +1,2 @@
+# shellcheck disable=SC2148
+NO_COLOR=true semgrep -c ../../../../rules/mastg-android-custom-intent-filter-intercept.yml ../MASTG-DEMO-0058/AndroidManifest_reversed.xml --text -o output.txt


The referenced rule file 'mastg-android-custom-intent-filter-intercept.yml' doesn't match the actual filename 'mastg-android-custom-intent-intecept.yml'. This will cause the semgrep command to fail.

Suggested change

NO_COLOR=true semgrep -c ../../../../rules/mastg-android-custom-intent-filter-intercept.yml ../MASTG-DEMO-0058/AndroidManifest_reversed.xml --text -o output.txt

NO_COLOR=true semgrep -c ../../../../rules/mastg-android-custom-intent-intecept.yml ../MASTG-DEMO-0058/AndroidManifest_reversed.xml --text -o output.txt

Copilot · 2025-08-31T18:31:05Z

demos/android/MASVS-CODE/MASTG-DEMO-0059/MASTG-DEMO-0059.md

+
+Let's run our @MASTG-TOOL-0110 rule against the manifest file and code.
+
+{{ ../../../../rules/mastg-android-custom-intent-filter-intercept.yml }}


The referenced rule file path 'mastg-android-custom-intent-filter-intercept.yml' doesn't match the actual filename 'mastg-android-custom-intent-intecept.yml'. This will result in a broken reference.

Suggested change

{{ ../../../../rules/mastg-android-custom-intent-filter-intercept.yml }}

{{ ../../../../rules/mastg-android-custom-intent-intecept.yml }}

Copilot · 2025-08-31T18:31:05Z

demos/android/MASVS-CODE/MASTG-DEMO-0058/AndroidManifestAttacker_app.xml

@@ -0,0 +1,25 @@
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    package="com.example.datainteceptor">


There's a typo in the package name: 'datainteceptor' should be 'datainterceptor' to match the correct spelling of 'interceptor'.

Suggested change

package="com.example.datainteceptor">

package="com.example.datainterceptor">

Copilot · 2025-08-31T18:31:06Z

demos/android/MASVS-CODE/MASTG-DEMO-0058/MastgTestAttacker_main_activity.kt

@@ -0,0 +1,15 @@
+package com.example.datainteceptor


There's a typo in the package name: 'datainteceptor' should be 'datainterceptor' to match the correct spelling of 'interceptor'.

Suggested change

package com.example.datainteceptor

package com.example.datainterceptor

Copilot · 2025-08-31T18:31:06Z

demos/android/MASVS-CODE/MASTG-DEMO-0058/MastgTestAttacker.kt

@@ -0,0 +1,24 @@
+package com.example.datainteceptor


There's a typo in the package name: 'datainteceptor' should be 'datainterceptor' to match the correct spelling of 'interceptor'.

Suggested change

package com.example.datainteceptor

package com.example.datainterceptor

ScreaMy7 added 6 commits May 4, 2025 23:25

first commit

ea2f924

fix markdown

3ab2c2d

fix

6a6b447

adding static testcase

bf6baa4

name change

afc7e8c

after review

c4092ce

cpholguera added ready-for-review MASTG Refactor labels May 17, 2025

cpholguera requested a review from TheDauntless June 6, 2025 07:56

TheDauntless requested changes Jun 16, 2025

View reviewed changes

Merge branch 'master' into TEST-0026-draft

f9191bd

cpholguera added changes-requested and removed ready-for-review labels Jun 26, 2025

updated demo

fafeb66

ScreaMy7 requested a review from TheDauntless July 4, 2025 08:57

cpholguera added changes-done and removed changes-requested labels Jul 8, 2025

added deprecated tag.

2c7ee5b

cpholguera requested a review from Copilot August 31, 2025 18:30

Copilot AI reviewed Aug 31, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Port MASTG-TEST-0026: Testing Implicit Intents (android) (by @appknox) #3271

Port MASTG-TEST-0026: Testing Implicit Intents (android) (by @appknox) #3271

Uh oh!

ScreaMy7 commented May 16, 2025

Uh oh!

ScreaMy7 commented May 16, 2025

Uh oh!

TheDauntless left a comment

Uh oh!

ScreaMy7 commented Jun 17, 2025

Uh oh!

TheDauntless commented Jun 18, 2025 •

edited

Loading

Uh oh!

ScreaMy7 commented Jul 4, 2025

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Aug 31, 2025

Uh oh!

Copilot AI Aug 31, 2025

Uh oh!

Copilot AI Aug 31, 2025

Uh oh!

Copilot AI Aug 31, 2025

Uh oh!

Copilot AI Aug 31, 2025

Uh oh!

Copilot AI Aug 31, 2025

Uh oh!

Uh oh!

		@@ -0,0 +1,28 @@
		---
		title: Implicit intent to intecept internal app components

	title: Implicit intent to intecept internal app components
	title: Implicit intent to intercept internal app components

		@@ -0,0 +1,2 @@
		# shellcheck disable=SC2148
		NO_COLOR=true semgrep -c ../../../../rules/mastg-android-custom-intent-filter-intercept.yml ../MASTG-DEMO-0058/AndroidManifest_reversed.xml --text -o output.txt


		Let's run our @MASTG-TOOL-0110 rule against the manifest file and code.

		{{ ../../../../rules/mastg-android-custom-intent-filter-intercept.yml }}

		@@ -0,0 +1,25 @@
		<manifest xmlns:android="http://schemas.android.com/apk/res/android"
		package="com.example.datainteceptor">

	package="com.example.datainteceptor">
	package="com.example.datainterceptor">

	package com.example.datainteceptor
	package com.example.datainterceptor

Uh oh!

Port MASTG-TEST-0026: Testing Implicit Intents (android) (by @appknox) #3271

Are you sure you want to change the base?

Port MASTG-TEST-0026: Testing Implicit Intents (android) (by @appknox) #3271

Uh oh!

Conversation

ScreaMy7 commented May 16, 2025

Uh oh!

ScreaMy7 commented May 16, 2025

Uh oh!

TheDauntless left a comment

Choose a reason for hiding this comment

Uh oh!

ScreaMy7 commented Jun 17, 2025

Uh oh!

TheDauntless commented Jun 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ScreaMy7 commented Jul 4, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Aug 31, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 31, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 31, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 31, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 31, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 31, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

TheDauntless commented Jun 18, 2025 •

edited

Loading