Topic · 1 article

android

Advanced level

Android XSS — exported Activity via ContentActivity (POE/Quora real report)

Walkthrough of Android XSS exploitable via an exported Activity intent in POE: how a filter-less ContentActivity leaks the WebView to attacker-controlled sites.

13 minandroidxssintent

Read article

Practice android with real labs

Apply the techniques in safe environments based on real bug bounty reports.

See android labs

All topics Academy

hunters training: 712
labs from real reports: 55
completions: 1,206
in bounties practiced: $213,970

46 flags captured this week·Real reports from HackerOne · Bugcrowd · Intigriti·No commitment·Free Academy

BBLabs · bug bounty training

Stop reading about bugs and start hunting them

Create your free account and practice on labs based on real reports that paid out thousands of euros. The Academy is free forever.

Create free account See the labs

No card · free Academy · cancel anytime