Components Named

Android components name Activity, Service, BroadcastReceiver, ContentProvider, and Intent — recognize them in YOUR $MOB_LAB manifest reading.

Components Named• Audio Walkthrough

00:00/03:19

Visual · t27_components_named

Component literacy. $MOB_LAB only. Original Cyberlium.

Exported components and deep links are mobile entry points — literacy names them before you trust a CVE headline.

Activities: UI screens, launchable via intents. Services: background work. BroadcastReceivers: respond to system and app events. ContentProviders: structured data sharing across apps. Intents: messages that start components — explicit vs implicit matters for hijack risk. Cyberlium names components on YOUR $MOB_LAB DVIA or self-built APK manifest snippets — not exported surfaces on production apps without authorization. Next: Permissions Model.

1. Four components (named)

Activity: single screen, android:exported controls external launch. Service: long-running tasks, bound vs started. BroadcastReceiver: BOOT_COMPLETED, custom actions — exported receivers are classic lab findings. ContentProvider: contacts-like URIs, grant-uri-permission flags.

On $MOB_LAB, list one example of each component from a course vulnerable app manifest.

Command guide

Try these commands — Four components (named)

═══ LINUX / macOS (Terminal Practice) ═══

Check system state and user context

Command — copy this

id
whoami
uname -a

Inspect network sockets listening for connections

Command — copy this

ss -tuln 2>/dev/null || netstat -tuln

Audit active processes

Command — copy this

ps aux | grep -v "\[" | head -15

═══ WINDOWS (POWERSHELL) ═══ Query user identity and system information

Command — copy this

whoami /all
Get-ComputerInfo | Select-Object CsName, OsName, OsVersion

Primary tools to practice this lesson: grep, python3. Reference sites: App components (https://developer.android.com/guide/components/fundamentals); Android manifest (https://developer.android.com/guide/topics/manifest/manifest-intro); OWASP MASTG (https://mas.owasp.org/MASTG/0x05b-Android-Platform-Overview/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Intents and entry points

Implicit intents can be intercepted if exported and unprotected. Deep links (VIEW intents with http/https schemes) expose navigation surface. Pending intents must be immutable where modern API requires.

Defenders review manifest merged output — students practice reading exported=true rows on lab APKs only.

3. Literacy ≠ unauthorized component fuzzing

Forbidden: probing exported components on stranger banking apps. Allowed: component table — type, example class name from lab APK, exported flag, one risk note.

Ship: component table for $MOB_LAB sample app. Next: Permissions Model.

4. What you ship: component table for $MOB_LAB

Four component types with lab examples and exported notes. $MOB_LAB named. chmod 600.

5. What you record before the next lesson

Date. Component table. $MOB_LAB named. File t27-m02-l02-components-named.txt chmod 600.

6. Wrong vs right: stranger phones vs lab emulator apps

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: Fuzz exported components on production social app. Skip manifest reading.
Right: Write component table for YOUR $MOB_LAB sample APK. Next: Permissions Model.

Hands-on Exercise