Mobile › Module 2 › Lesson 2
Components Named
Android components name Activity, Service, BroadcastReceiver, ContentProvider, and Intent — recognize them in YOUR $MOB_LAB manifest reading.
Visual · t27_components_named
Component literacy. $MOB_LAB only. Original Cyberlium.
Opening
Exported components and deep links are mobile entry points — literacy names them before you trust a CVE headline.
Activities: UI screens, launchable via intents. Services: background work. BroadcastReceivers: respond to system and app events. ContentProviders: structured data sharing across apps. Intents: messages that start components — explicit vs implicit matters for hijack risk. Cyberlium names components on YOUR $MOB_LAB DVIA or self-built APK manifest snippets — not exported surfaces on production apps without authorization. Next: Permissions Model.
1. Four components (named)
Activity: single screen, android:exported controls external launch. Service: long-running tasks, bound vs started. BroadcastReceiver: BOOT_COMPLETED, custom actions — exported receivers are classic lab findings. ContentProvider: contacts-like URIs, grant-uri-permission flags.
On $MOB_LAB, list one example of each component from a course vulnerable app manifest.
Command guide
Try these commands — Four components (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
App components — https://developer.android.com/guide/components/fundamentals (Activity/Service/Broadcast/Provider) Android manifest — https://developer.android.com/guide/topics/manifest/manifest-intro OWASP MASTG — https://mas.owasp.org/MASTG/0x05b-Android-Platform-Overview/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export MOB_LAB=${MOB_LAB:-$HOME/cyberlium-lab/t27-mob}
cat > "$MOB_LAB/notes/android-components.txt" <<'EOF'
Activity: UI entry point — exported=true increases attack surface
Service: background work — bind vs start; check intent filters
BroadcastReceiver: system/app events — exported receivers are high risk
ContentProvider: data sharing — URI permissions + grant-uri-permission review
lab: map components in YOUR demo.apk manifest stub only
EOFCommand — copy this
grep -E 'Activity|Service|Broadcast|ContentProvider|exported' "$MOB_LAB/notes/android-components.txt"
python3 -c "print('Name components in YOUR lab APK — never reverse stranger production apps without RoE')"Primary tools to practice this lesson: grep, python3. Reference sites: App components (https://developer.android.com/guide/components/fundamentals); Android manifest (https://developer.android.com/guide/topics/manifest/manifest-intro); OWASP MASTG (https://mas.owasp.org/MASTG/0x05b-Android-Platform-Overview/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Intents and entry points
Implicit intents can be intercepted if exported and unprotected. Deep links (VIEW intents with http/https schemes) expose navigation surface. Pending intents must be immutable where modern API requires.
Defenders review manifest merged output — students practice reading exported=true rows on lab APKs only.
3. Literacy ≠ unauthorized component fuzzing
Forbidden: probing exported components on stranger banking apps. Allowed: component table — type, example class name from lab APK, exported flag, one risk note.
Ship: component table for $MOB_LAB sample app. Next: Permissions Model.
4. What you ship: component table for $MOB_LAB
Four component types with lab examples and exported notes. $MOB_LAB named. chmod 600.
5. What you record before the next lesson
Date. Component table. $MOB_LAB named. File t27-m02-l02-components-named.txt chmod 600.
6. Wrong vs right: stranger phones vs lab emulator apps
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Fuzz exported components on production social app. Skip manifest reading.
Right
Write component table for YOUR $MOB_LAB sample APK. Next: Permissions Model.
Mission: name components in YOUR lab APK
1) Define Activity and Service in one line each. 2) Note one exported component risk. 3) Cite lab APK name from $MOB_LAB. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Merged manifest in Android Studio beats guessing from decompiled smali alone.
Knowledge Check
APPLY: ContentProvider primarily:
Multiple choice
Knowledge Check
APPLY: True or False: android:exported=true can expose components to other apps.
True or False
Knowledge Check
APPLY: Component literacy on Cyberlium uses:
Multiple choice