What problem does it solve? Android apps often expose Activities, Services, Broadcast Receivers, and Content Providers to any installed app through missing or weak export guards, creating auth bypass, data theft, and privilege escalation risks that are tedious to enumerate manually from a manifest. ## Core Features & Use Cases - Automated export enumeration: Parses manifest.json to list components reachable by any app (explicit exported="true" or implicit intent-filter exports), filtering out signature-guarded components and flagging weak normal/dangerous permission guards. - Ready-to-run test commands: Generates per-component adb shell am start/broadcast and Drozer commands for human-run dynamic confirmation on an authorized device. - TTP catalog and chaining playbook: Documents eight attack techniques (provider SQLi, path traversal, intent redirection, _display_name traversal, task hijacking) with disclosed-report citations and MASVS/MASTG mappings. - Use Case: During an authorized bug bounty assessment, point the detector at a decompiled target's manifest to instantly surface an exported provider with no permission guard, then confirm SQL injection with the generated Drozer command. ## Quick Start Run the enumerate_exports script against a target hash to list unguarded exported components and their adb test commands.
