Exported Trust (Day 01)

A small, unobfuscated APK (com.huntress.mobile.d01...). Unpack it (an APK is just a ZIP), decode the manifest with androguard and decompile the DEX with jadx — three classes, no obfuscation.

ChallengeActivity is marked android:exported="true" and registered for the deep link huntress01://exported-trust/unlock. It reads answer and case_id from either intent extras or the URI, then builds a loopback scoring request carrying a hardcoded client_secret and loads it in a WebView — with no caller check whatsoever. That's the whole lesson: an exported component the developer assumed only their own app would call, reachable by anyone (adb, another app, or the browser following the deep link).

The expected answer is sitting in plain text in assets/huntress_puzzle.json:

{"schema":"huntress.mobile.puzzle.v1","day":1,"codec":"plain","data":"ANS-DACC86F43B0B1C1A"}

So the intended solve is to fire the exported activity (via the deep link or an am start) with answer=ANS-DACC86F43B0B1C1A and let the app submit the proof itself.