27 notes
Flag 27 - Message replies
Sending IPC messages with a reply Messenger to capture response data from services.
Flag 26 - Basic message handler
Communicating with background Services via Messenger IPC and Message handlers.
Flag 25 - Service lifecycle
Binding to Android Services (bindService) and navigating service lifecycle states.
Flag 24 - Basic service start
Invoking exported Android background Services directly using startService.
Flag 23 - Hijack pending intent
Mutating mutable PendingIntents to escalate privileges and access non-exported components.
Flag 22 - Receive pending intent
Triggering PendingIntents received from services to execute unauthorized actions.
Flag 21 - Hijack notification button
Extracting and manipulating PendingIntents embedded in system notification actions.
Flag 20 - Notification button intents
Spoofing notification action button intent broadcasts to trigger background handlers.
Flag 19 - Widget System Intents
Spoofing App Widget update broadcasts (ACTION_APPWIDGET_UPDATE) to extract widget data.
Flag 18 - Hijack broadcast intent
Hijacking unsecured broadcast intents in transit to intercept leaked flag payloads.
Flag 17 - Receiver with response
Broadcasting intents to exposed receivers and reading returned result data.
Flag 16 - Basic exposed receiver
Exploiting exposed BroadcastReceivers by sending crafted broadcast intents.
Flag 15 - Create a intent-flag15 link
Crafting intent:// URI scheme links to invoke Android components directly from HTML.
Flag 14 - Hijack Web Login
Interception of web login implicit intents to capture authentication tokens.
Flag 13 - Create a hex-open link
Exploiting BROWSABLE deep links (hex://open) with browser application ID extras.
Flag 12 - Careful Intent Conditions
Satisfying complex Intent Filter conditions combining actions, categories, schemes, and types.
Flag 11 - Responding to an Implicit Intent
Building a custom activity to handle implicit intents and return required response data.
Flag 10 - Hijack Implicit Intent with the Flag
Hijacking implicit intents by registering a matching intent filter to steal outgoing data.
Flag 9 - Receive Result with Flag
Capturing and parsing sensitive flag data returned via onActivityResult Intent extras.
Flag 8 - Did You Expect a Result?
Using startActivityForResult to invoke an activity and trigger its result handler.
Flag 7 - Activity Lifecycle Tricks
Manipulating activity lifecycle state transitions (onPause/onResume) to trigger flag logic.
Flag 6 - Not Exported
Reaching non-exported Flag6Activity via Intent redirection through an exported activity.
Flag 5 - Intent in Intent
Wrapping a target Intent inside an extra parameter to exploit Intent-in-Intent parsing.
Flag 4 - State Machine
Invoking activities in a sequential state machine pattern to reach the final flag state.
Flag 3 - Intent with a Data URI
Constructing Intent Data URIs (https://hextree.io/flag) to pass URI verification.
Flag 2 - Intents With Extras
Passing required Intent extras to satisfy condition checks in Flag2Activity.
Flag 1 - Basic Exported Activities
Bypassing access controls by invoking explicit intents against exported Flag1Activity.