Mobile Hacking Labs
inkFiles
InkFiles is a small Android file manager that lets other apps hand it files to preview, including Office documents like XLSX spreadsheets.
A previewer functionality in this app reproduces a critical vulnerability found in a widely-used Android file-manager system app.
Objective
Remotely exploit this app by sharing a malicious XLSX file to read a private file from the device and exfiltrate its contents.
Skills Required
- Reverse Engineering: Proficiency in disassembling and analyzing compiled code.
- WebView exploitation: abusing JavaScript and local-file-access settings
