> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/android-appsec/static-analysis/mobsf/manifest-file-analysis.md).

# Manifest File Analysis

### Check MinSDK Version

#### Using `aapt` (simple and common)

```bash
aapt dump badging <apk-file> | grep sdkVersion
```

Example output:

```
sdkVersion:'23'
targetSdkVersion:'33'
```

* **`sdkVersion`** → Minimum SDK (Min SDK) required
* **`targetSdkVersion`** → Recommended target SDK
* So here, `23` = Android 6.0 (Marshmallow).

***

#### Using `apktool`

If you’ve decoded the APK with `apktool`:

```bash
apktool d <apk-file> -o apk_decode
```

Then open:

```
apk_decode/AndroidManifest.xml
```

Look for the `<uses-sdk>` tag:

```xml
<uses-sdk android:minSdkVersion="23" android:targetSdkVersion="33"/>
```

* `minSdkVersion` → Minimum SDK required
* `targetSdkVersion` → Target SDK recommended

***

#### Quick reference for SDK numbers

| SDK | Android Version |
| --- | --------------- |
| 23  | 6.0 Marshmallow |
| 24  | 7.0 Nougat      |
| 25  | 7.1 Nougat      |
| 26  | 8.0 Oreo        |
| 33  | 13 Tiramisu     |

So if you see `sdkVersion: 23`, it **requires at least Android 6.0** to run.

***

### Exported Activities, Services, and Broadcast Receivers

* **Not all are inherently vulnerable.**

| Component Type         | When it’s a security issue                                                    | Notes                                                                                                                                                                             |
| ---------------------- | ----------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Activity**           | `android:exported="true"` AND accessible to other apps **without permission** | If it handles sensitive data (auth, intents, file access), it is **reportable**. Preview or debug activities may not be exploitable but should still be restricted in production. |
| **Service**            | Exported AND not protected by a **signature-level permission**                | If normal/dangerous permission is used or no permission, other apps can interact with the service → reportable.                                                                   |
| **Broadcast Receiver** | Exported AND not properly protected                                           | Same logic as services. If it’s intended for internal system events, it should not be exported without protection.                                                                |