Enumeration

AndroidManifest.xml

• Review the androidmanifest.xml for services
• Are they exported?
• What custom permissions are enforced?
• Reverse engineer the services
  • What do they do?
  • What are the required inputs?

Drozer

run app.service.info -a com.your.app

Starting a Service

Drozer

run app.service.send com.your.app com.your.app.service --msg 12345678 --exrtra string com.your.app.string "string value" --bundle-as-obj

ADB

adb shell am startservice com.your.app/.yourservicesubclassname