The challenge
Trace attacker-controlled extras through an internal navigation boundary.
One question, answer: “For case MOB-03-8006859B52 in package com.huntress.mobile.d03.v8006859b5257: Trace attacker-controlled extras through an internal navigation boundary. Submit only the exact backend answer code returned for this case.” Artifact: intent_injection.apk. Format: ANS- followed by exactly 16 uppercase hexadecimal characters; no spaces or explanatory text, normalization exact.
How this lane was solved is explained once, in the Network Config Split write-up (Day 10, the first Android solve). Short version: every assigned APK carries assets/huntress_puzzle.json, and decoding it gives the answer. The app never has to run.
Reading the prompt: what it said we'd need
| Clue | What it pointed to | What I did about it |
|---|---|---|
| attacker-controlled extras | Intent extras an outside app can set | Static route; no app launched |
| internal navigation boundary | an exported screen that forwards to a private one | The packaged puzzle (Base64) gave the code |
Honest note: the prompts describe real Android attack surface, which would mean installing and driving the app. In this event the answer sat in a packaged JSON file that the app's own code never reads, so none of that was needed.
Safety
Static only. The APKs were opened as zip files on our Kali VM and one JSON asset was read; nothing was installed or run.
What was in the files
intent_injection.apk, about 12.7 KB: one classes.dex, the manifest, a few resources, and assets/huntress_puzzle.json:
{"schema":"huntress.mobile.puzzle.v1","day":3,"codec":"base64","data":"QU5TLUU0QzhFMzVBOEE5QjVENjc="}
Codec base64: data is the answer in Base64 (QU5TL… is Base64 for ANS-).
The Time Trial and Mastery APKs use the same template with different values.
Single Solve
Started untimed to download the APK, decoded by our shared Android solver, and sent once: ANS-E4C8E35A8A9B5D67 → CORRECT in 1,320 ms (start to submit), flag ca67be78…13c7.
Solver: our Android solver from Day 10, shared by Days 1–10. It reads the asset from the zip, checks the schema, decodes the codec, and returns the answer only if it is exactly ANS- + 16 uppercase hex; anything unknown stops the run before sending. Its tests: 10/10.
Time Trial
A 6-second clock. Same puzzle schema and codec as the Single Solve.
started_at 2026-10-10T15:56:27.239Z deadline 2026-10-10T15:56:33.239Z answer_ids ['answer']
artifact intent_injection_time_trial.apk 12704 bytes sha256 9d8ba27fa0f621e0… (checked)
answer: ANS-31B2DAB8A17A4D6F
start 513 ms
artifact 296 ms
solve 0 ms
submit 731 ms
TOTAL 1540 ms
result CORRECT flag d745300e…2d64
Mastery
A 6-second clock. 3 APKs, one per set; the questions name them delivery N: …_mastery_0N.apk. Same puzzle schema and codec as the Single Solve.
started_at 2026-10-10T15:56:29.828Z deadline 2026-10-10T15:56:35.828Z answer_ids ['set1.answer', 'set2.answer', 'set3.answer']
artifact 01-intent_injection_mastery_01.apk 12704 bytes sha256 4128d46200d762e7… (checked)
artifact 02-intent_injection_mastery_02.apk 12704 bytes sha256 af27a309f396766b… (checked)
artifact 03-intent_injection_mastery_03.apk 12704 bytes sha256 f17dd968f471624c… (checked)
set1.answer: ANS-D013DAB129ECC3D5
set2.answer: ANS-BD7AF4BB5C717C53
set3.answer: ANS-CA2248A783994E07
start 508 ms
artifact 329 ms
solve 1 ms
submit 739 ms
TOTAL 1577 ms
result CORRECT flag f1e10b62…5164
Time to solve
All three modes were solved on 2026-10-10 by 15:56:30 UTC, 4 min 51 s after the first start; each mode went through on its first submit, and both timed runs were ranked.
Takeaways
- Read every packaged file before assuming the app must run. The answer sat in
assets/, unread by the app's code. - The answer format is a strong check.
ANS-+ 16 uppercase hex rules out wrong decodings (Day 10's othersplitreading, a wrong Caesar direction) before anything is sent.