IPC

Pentesting Android Services # Services are the Android component that runs long-lived work in the background. Think of an app that keeps uploading large files, plays audio while the UI is closed, or syncs data on a schedule. Like every other component, a Service has to be declared in AndroidManifest.xml under the <service> tag, and even when it is exported it can be locked down further with android:permission. Why does this matter? Because a Service is often the piece of the app that actually does the privileged work: talking to internal APIs, touching files, or moving data between processes. If another app can reach that Service from outside the sandbox, it can effectively borrow the victim app’s privileges to run those internal actions.