Búsqueda de activities con exportación habilitada
# AndroidManifest.xml
## explícitamente
grep "<activity" app-decompiled/AndroidManifest.xml | grep "android:exported=\"true\""
## implícitamente
grep "<intent-filter" -B 1 app-decompiled/AndroidManifest.xml | grep "<activity" | grep --invert-match "android:exported=\"true\""
# Drozer
run app.activity.info -a <app-package-name>
Iniciar activity con exportación habilitada
# Android Debug Bridge (adb)
adb shell am start <app-package-name>/.<activity-name>
adb shell am start "<data>" <app-package-name>/.<activity-name>
adb shell am start -d "<scheme>://<host>" <app-package-name>/.<activity-name>
adb shell am start –a <action> –c <category> <app-package-name>/.<activity-name>
adb shell am start -n <app-package-name>/.<activity-name> --es <parameter> <numerical-value> --es <parameter> "<string-value>"
# Objection
android hooking list activities
android intent launch_activity <activity-name>
# Drozer
run app.activity.start --component <app-package-name> <app-package-name>.<activity-name>