Mobile › Module 2 › Lesson 2
Components Named
Android components name Activity, Service, BroadcastReceiver, ContentProvider, and Intent — recognize them in YOUR $MOB_LAB manifest reading.
Visual · t27_components_named
Component literacy. $MOB_LAB only. Original Cyberlium.
Opening
Exported components and deep links are mobile entry points — literacy names them before you trust a CVE headline.
Activities: UI screens, launchable via intents. Services: background work. BroadcastReceivers: respond to system and app events. ContentProviders: structured data sharing across apps. Intents: messages that start components — explicit vs implicit matters for hijack risk. Cyberlium names components on YOUR $MOB_LAB DVIA or self-built APK manifest snippets — not exported surfaces on production apps without authorization. Next: Permissions Model.
1. Four components (named)
Activity: single screen, android:exported controls external launch. Service: long-running tasks, bound vs started. BroadcastReceiver: BOOT_COMPLETED, custom actions — exported receivers are classic lab findings. ContentProvider: contacts-like URIs, grant-uri-permission flags.
On $MOB_LAB, list one example of each component from a course vulnerable app manifest.
Command guide
Try these commands — Four components (named)
═══ LINUX / macOS (Terminal Practice) ═══
Check system state and user context
Command — copy this
id whoami uname -a
Inspect network sockets listening for connections
Command — copy this
ss -tuln 2>/dev/null || netstat -tuln
Audit active processes
Command — copy this
ps aux | grep -v "\[" | head -15
═══ WINDOWS (POWERSHELL) ═══ Query user identity and system information
Command — copy this
whoami /all Get-ComputerInfo | Select-Object CsName, OsName, OsVersion
Primary tools to practice this lesson: grep, python3. Reference sites: App components (https://developer.android.com/guide/components/fundamentals); Android manifest (https://developer.android.com/guide/topics/manifest/manifest-intro); OWASP MASTG (https://mas.owasp.org/MASTG/0x05b-Android-Platform-Overview/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Intents and entry points
Implicit intents can be intercepted if exported and unprotected. Deep links (VIEW intents with http/https schemes) expose navigation surface. Pending intents must be immutable where modern API requires.
Defenders review manifest merged output — students practice reading exported=true rows on lab APKs only.
3. Literacy ≠ unauthorized component fuzzing
Forbidden: probing exported components on stranger banking apps. Allowed: component table — type, example class name from lab APK, exported flag, one risk note.
Ship: component table for $MOB_LAB sample app. Next: Permissions Model.
4. What you ship: component table for $MOB_LAB
Four component types with lab examples and exported notes. $MOB_LAB named. chmod 600.
5. What you record before the next lesson
Date. Component table. $MOB_LAB named. File t27-m02-l02-components-named.txt chmod 600.
6. Wrong vs right: stranger phones vs lab emulator apps
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Fuzz exported components on production social app. Skip manifest reading.
Right
Write component table for YOUR $MOB_LAB sample APK. Next: Permissions Model.
Mission: name components in YOUR lab APK
1) Define Activity and Service in one line each. 2) Note one exported component risk. 3) Cite lab APK name from $MOB_LAB. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Merged manifest in Android Studio beats guessing from decompiled smali alone.
Knowledge Check
APPLY: ContentProvider primarily:
Multiple choice
Knowledge Check
APPLY: True or False: android:exported=true can expose components to other apps.
True or False
Knowledge Check
APPLY: Component literacy on Cyberlium uses:
Multiple choice