When they come back.
Let's do some practical exercises regarding to our content provider and we start with our screen injection
attack, which sounds amazing, but it's really not that common anymore.
Nevertheless, export content provider are still pretty dangerous and we will find out why.
So therefore, let's go.
So here we are back at the Ubuntu VM.
We've got our smartphone over here and we once again install the safe application because this one has
a really nice text service regarding to content provider.
So within apps and see, yes, here we have it.
So we install the old version, I mean, not the old version.
We are installing the APK and not the sorry, the decoded version.
Okay.
And I guess we have to set it up first, which is a little bit annoying and therefore I will fast forward
this process.
Yes.
So we want to give access to files and media and then yes, we have to set it up.
And we also get still this warning, but it runs on the smartphone perfectly.
So I'm using a next device in app version 30 and this works probably.
Okay.
So I will fast forward this process right now.
Okay.
So here we are back and we have already set up this application.
So we've got the service in there, we've got a password, we've got an pin and a bunch of other stuff.
So therefore, let's have a look how we can how we can exploit this, this content provider in there.
So therefore we are having a look into the Android manifest.
So within the Decompile version, we still get it over here.
Here we have the Android manifest example.
Yes.
And here we can see we have two condom provider.
This one and this one.
Okay.
In this video, we will have look into this condom provider, which is simply just in database interaction.
And this one over here, this is in file provider, which gives us the possibility to search for path
traversal vulnerabilities.
All right.
We will do this in the next video.
For now, we focus on interacting with the database by looking at this one.
We do not know if it's in the database or if it's in file provider.
So we will have to take look into the source code to figure this out.
But before we do this, let's first discuss this here real quick, because there's a bunch of stuff
which is pretty interesting.
So therefore, let's get back on the graphic tablet.
Okay.
So here we have our content provider, this one over here, and we've got the authority name, which
is this part.
Okay.
And then we've got exported through.
Amazing.
This means this content provider is available from the outside world.
We can interact with this one.
So that's good to know.
Multiple process will be ignored and we've got the Android name.
So this one over here, this is the class name.
It has been defined in here.
And this is something we we want to check out later on.
I mean, we have to talk about reverse engineering yet.
And therefore, I will do the reverse engineering approach and provide the Decompile source code.
It's not the original code.
I cannot find it anymore online, but it's good enough to perform our reversing tasks already.
So we know we've got DB content provider class and this is the authority name, which means we've got
something like content code on less slash and then com and w, r and so on.
And then we've got this part may be also included over here.
And now there's an interesting part because we also got this line and this line is now a path permission.
So this one is telling us we've got now an database.
This is our content provider.
I mean, we do not know this right now, but this is something we will figure out in just a moment.
So we've got the database and this database has now different tables.
We do not know how many, but we can already see one because this one over here and this is the sorry,
wrong colour.
And this one, this is now the table.
Let's clean this up.
The table keys.
Okay.
To be more exact, the table name can be still different.
But this is the that's the scheme, the URI to access the table.
So we've got a table in here that might be keys.
What could be also named?
Completely different.
But we can access it via this URI.
Okay.
But why is this one listed over here separately?
And what's about the other tables?
Well, this one has been listed separately because we've gotten custom permission for this table.
This means if you want to read or write to this table, we need to have this permission.
This one and or this one depends on the action we want to perform, of course.
And those two permissions are defined over here.
So now we're dealing with custom permissions, which means the content provider is being exported.
So this one over here, this is exported.
But the keys table has been locked down.
The keys table is being protected by those two permissions.
We can include those two permissions in our own application.
And if we ask the user nicely, then the user might grant us the permission.
And then we can we can access this anyway from our malicious application.
In this part.
But we've got this protection level dangerous.
Therefore, the user might get in pop up.
It depends on the Android version and the smartphone we are running, but normally speaking the user
should get and pop up over here, so there should be some pop up.
Do you want to give access for this app and the user has to accept it?
To be honest, I wouldn't count this as a big deal because the user might easily get those permissions
to our application and then we might be able to yet to access those sensitive data anyway.
So therefore, inserting custom permissions within protection level dangerous.
I guess that's not a good deal.
At least that's the way I see it right now.
If the protection would be the protection level would be something like signature and then we are talking
about something different.
So that's totally different story.
This one, this would be perfect.
We will talk about signature and designing process in another topic.
So far, it simply just means if we have an application and another application has been signed with
the same key, then those two can exchange information easily.
But this of course excludes other applications.
So it always depends on the use case the developer wants to do or on the data the developer is providing
over here.
So it always depends on the type of data we are sharing.
If those data are critical, for example, if these are our passwords and our password safe, then protection
level dangerous might not be sufficient enough.
We should go for signature, but if they are being encrypted anyway, then dangerous might be still
okay.
All right.
So it depends on the data itself.
Okay.
But back to this one over here, which looks like a complete mess.
So maybe let's clean this up and summarize it over here real quick.
So we've gotten database and we've got this authority name and this one.
This is this is our class, which is defined in the content provider.
And this has at least one table, and this table can be addressed in the following way content and slash
then our authority name and we've got this path keys, wrong color.
Let's be constant and that's in capital K.
Okay, this key's table is being protected with these two permissions, which is not a big deal.
We can circumvent this.
We will also do this later on.
We will write our own application and include them into this application, but for now at least, it
is protected.
So the user might have to grant this permission.
Okay, so now I would suggest let's decode this web.
So let's get back the source code and let's have a look into this class to see what's going on over
here.
Alrighty, let's do this.
So I clear the screen and then.
Och, I'm using the Chad X tool if you want to follow this.
Let me get your help first.
If you want to follow this, I recommend using the trade excuse tool because there you have some some
connection between those classes.
You can simply double click on something.
But we haven't talked about reverse engineering yet and therefore I will provide you the source code.
I mean, it's the compiled code anyway.
So this will be our workspace and therefore I go for the Chad X Command Line tool.
All right.
So how can we do this?
We've got trade.
We need to provide an input file which is unsafe to ABCC.
And then simply defining an output directory.
And that's all.
So the compiled code.
Okay.
We could also limit it to just hefty sources and not they compile those resources, but we stick all
together.
So all in in this directory now we can open the whole directory with wizards to do code.
Okay.
So this is exactly what you will get from me right now.
The these two directories, the resources, which includes the Android manifest and also the sources
which contains the source code.
So let's see which cluster we have to look for.
We need to take a look into this one DB content provider.
So let's find this.
It's not that it's not that hot that we already have it.
All right.
Yes.
And we can already see we've got the content scheme.
So exactly like we have written it down before.
So by using this scheme in exactly this way with this DB content provider slash keys we are addressing
and table.
But the table doesn't have to be named exactly like this one.
So it could be keys, but it could be also completely different.
This is some kind of alias for a certain table.
All right.
Okay.
For now, we do not have to bother too much about this because we will figure out how how to deal with
this later on if those names doesn't match anymore.
Okay.
For now, we can see we've got one content.
So one alias for keys and we've got another table over here.
Passwords.
I mean, once again, it hasn't to be named passwords, but that's the alias name for this one.
All right.
So at least we are dealing with two tables and now we already got something interesting.
Our content provider is being exported, keys has been locked down, but passports is free.
So at least we should be able to query this one, this reference, whatever's inside here and get out
these these data, which is super amazing.
Right.
If they are interested in those data.
So we will we will have to look into this one later.
Okay.
And then we've got a bunch of stuff.
I mean, these are references, IDs.
Who knows?
This one over here sounds interesting.
We've gotten P.W. RD helper, so maybe let's get this a little bit out.
Then we've got URI matcher.
So this matches our Uris from the.
From here.
Here we can see we've got Uri Pass OC.
And then let's see.
All right.
And then we've got our familiar methods.
So on the first view, it looks like a complete mess.
But you do not have to bother too much about this.
And let me get back the graphic template and then I will show you why.
All right.
So if you still remember the the theory part, then we've got our content resolver on the client side.
And the content resolver is asking the content provider to to provide some access to the data, the
content providers returning back some some cursor and also giving access to those methods.
So here we've got the method delete, for example.
So this is simply just deleting an entry in a table beside this.
We also got insert in this one over here.
So here we can insert a new value into a table.
Then we've got query.
This is maybe the most interesting part right now because here we can see we've got now all these five
parameters.
We've got the theory, we've got this projection, we've got selection, selection arcs and sort order.
So out of these parameters and SQL syntax will be formed.
So we're having something like Select and then we've got our projection.
And protection from then we've got our this one, our in wrong color.
Let's make green in and then we've got wear and we've got all the rest and selection, selection, axe
sort order.
So out of these parameters, this is coded syntax being formed.
And this is exactly our inflection point later on in this part over here and this projection.
But we will discuss this later.
For now, let's finish the discussion of this file over here and then let's see if we can already reconstruct
the database and also the tables based on the source code.
Because if you want to perform an injection, we need to be familiar with this structure, to name it
correctly, otherwise it won't work.
All righty, so let's clean this up and let's see.
All right.
So, yes, we have talked about recovery and also about insert, and this one can be ignored right now.
The part above has been also analyzed, and this one is interesting because here we are now having a
method on create, but this time we are not having the activity on create method we might have in creation
of our database.
And this one is pretty important because if we are creating our database within this part over here,
then we can make some conclusions about the structure of our database, which tables are in there,
what are those columns and how they are being interconnected.
So this is something we definitely want to figure out and therefore we will have to look into this one
afterwards.
Okay.
After the query method, there's only the update method left and this can be simply used to to update
our entries in a table.
So all of this will be done later.
We will play around with insert delete and also update statements and of course our query statement
to to inject our own SQL syntax into this one.
Right before we can do this, there's only one task left and this is this one over here.
So therefore, let's figure out what's the structure of this database.
Okay, so here we have the p.w d helper.
Let's see, p.w dx helper is over here and this one.
All right.
This is defining the database name.
So within the data data directory, we're having our package name and in there we're having an and directory
named DB and this is the file in this directory.
So this database will be stored in there.
We could download this into our laptop in this file with ADB pool and first we have to place it on the
SD card.
But then we can download it and we can use tools like a SQL light browser.
I guess it's Escalade browser three or simply the command line tool for SQLite.
And then we can, we can access and query this database and can find out the structure anyway.
But we can also do this over here because it might not have been initialized completely or there might
not be any value in there.
So therefore let's also do the reversing approach, but nevertheless, feel free to try this one over
here.
Okay.
So far there's nothing interesting until here and here.
Once again, we've got another on create method and this time we've got something p.w de p w table this
way.
So we've got p.w table and here we can see SQL create entries.
All right.
And this one is not being referenced anywhere.
So it might be in static field.
And therefore, let's have a look into this this class over here and we can find this here.
All right, let's open it.
Perfect.
This is the final structure of our database.
So now we've got everything completed.
We've got the database file, which is named database.
I'm not sure anymore.
It doesn't really matter.
So this is our database.
Okay.
The database name was part of the authority, so I guess the provider may have to look it up in case
if it's wrong.
The be provider, that's the name.
And here we can now see we've got a table.
Here's the table name passwords.
So we've got the table named passwords.
And we also got them table name key.
And this one is now interesting.
Key because if you remember the the content you re regarding to this key table has been referenced with
keys so the reference is this content you keys.
This is the way how we access this.
This table with a content provider.
But if we are using it within an SQL injection, we have to use the exact the correct name of this table
name, which is key.
So not the content reference.
We have to use the correct table name.
So this one over here, this is simply just an alias for our content provider to access this table.
All right.
Okay.
And let me clean this up.
Okay.
And now let's see what what entries do we have?
We've got email, password, service, user name.
And for now, we do not know if they are in passport or in key.
Here we've got passport once again.
Okay.
Interesting, but they are also named different capital P, lower P.
Here we've got PIN.
And then yes, this is what I was looking for.
So here we've got now create table key and we can see this table sorry.
This table key has the column password, which is text, which is the primary key and it also has an
pin which is text.
So this one has now two columns which is password and pin, and both of them are text.
So this could mean that they are being stored in clear text.
It could be also encrypted and base64 encoded, for example.
Then this text parameter would also make sense.
So this is something we need to figure out, but we can already see the structure of our table.
So our table key has the columns, password and pin.
Okay?
And then we've got this create table over here and let's see.
Okay.
And this one is for our passport.
Yes, this is for our passports.
And this one has a lot of entries.
We've got an ID, which is the primary key.
So there will be in column name ID that will be also in column name service.
There will be in column name, username, passport.
Interesting.
Once again, passport here, lowercase here, capital.
And this time passport is blob.
So this means it's binary data.
So this is most likely being encrypted.
Okay.
And last but not least, we've got this email.
All right.
And these are the things we have already figured out just by reverse engineering a few classes.
So we know the database and the B provider.
We've got two tables in there.
And the most interesting one is the key table.
But this is also the one which has been locked.
So we cannot access this.
All right.
So far, so good.
Our attack vector is now the following.
So the key has been locked, but the lock is only available from the outside world.
So the DB provider has been exported.
And if we come from outside and we try to access this, then we get denied if we are not having the
permission to access this one.
But if we are able to query this one in the passports table, then we are already in.
So this lock is not taking place anymore.
And if we now can smuggle our own syntax, our own SQL query.
Oops.
Chris, I guess written something differently.
That's the way if you now smuggle our own SQL query into this passwords, then we might be able to access
this.
So this is our attack plan.
But before we do this, let's first find out how we can interact with this one.
So how can we how can we query those tables and in this case, the passwords table?
Because the key table cannot be queried.
And this is also something we will find out right now.
All right.
Let's do this.
Okay.
So to do this, we are using once again the ADB shell.
And this time we're not using the activity manager.
This time we're using content.
Let me close this one.
So on the first view, it looks like a complete mess.
Complex parameters.
Things we we do not know right now what is extra binding and things like this.
But we can make this a little bit easier.
Those lines over here, if the text starts over here, then we've got a new chapter.
So this one is ADB Shell Content Insert.
So here we are dealing with inserting new data.
Here we can see we've got update and this one is delete and this one is query.
And then we've got content called content read and some other stuff.
The second half can be simply ignored right now because this is regarding to file access which will
be discussed in the next video.
Then we will find out how path traversal will work.
For now, we only focus on the first half of this one interacting with the database and now we know
we are dealing with the database, at least for our content provider over here in this one.
But we have it here, this one, this DB content provider.
All right.
Okay, so maybe let's put this on the right.
Let's close this.
Okay.
So now the question, how can we access those tables?
So within here we are now having a database which is stored in a protected directory, but the access
to the database IP to the content provider is being is being available because it has been set exported
through.
So to do this, it's very easy.
All we need to do is we need to use content and then let's see, query, query and then we do not have
to take care about all these complex parameters.
I mean, we know what protection is, how and where statement works and things like this, but we do
not have to take care about this because if we are not applying any parameter, then we are simply selecting
everything from this table.
Easy, right?
Yes.
So how can we address this table?
Well, all we need to do is we need to provide content and write this down as the comment over here.
So content and then the authority name matches this one.
And then slash and the table name.
This is how how to access this table.
And we do not have to do this on our own because this is already being defined in the DB content provider.
So if we scroll up a little bit, yes, here we have it.
And so here we can see we've got content authority and then the table name perfect.
So we simply copy this part and we are inserting over here and this is how to perform and select all
from the passwords table.
Nice, isn't it?
Let's do this in 3 to 1.
There we have it.
Nice.
We can see we've got the service banking username and password block.
We can extract the binary data out of this because now it's just saying, okay, this is binary data
and it's not displaying it, but we can deal with this one.
Nevertheless, those data are being encrypted, so we do not get an advantage out of this unless we
can decrypt it, which is not possible right now because we do not know how to do this and it might
be also protected with the user password, which makes it even more impossible if the user password
has been chosen correctly.
So these are many.
What if cases and this is something we do not want to discuss right now.
We will have a separate section about this cryptography.
But for now, we want to talk about content providers.
Okay.
All right.
So last but not least, we've got this email, which is an information leakage.
And if you take a look at the at the structure, underscore ID, service, username, password, email,
this is exactly what we have reverse engineer.
So all we need to do is simply following down the line of our content provider because there it's being
defined how to access the database and also how how the database is being created.
So there might be some reference to this.
Righty.
Okay.
So this is a way how to interact with this one and what happens if you try to access the protected ones
and you protect that ones.
This keys in this one over here.
So let's see.
Now we want to carry this one.
And here we're getting now an error.
Let's make this a little bit larger.
Okay.
Permission denied.
What we expect it.
And if we can see, we try to access the keys from which this process it it really doesn't matter.
All it matters is we are trying to access this from the user ID to 1000, which is our ADB shell in
this one over here.
So the ADB shell has not the permission to query this.
If you would get root privileges, then of course this is possible.
But then it's also not an attack vector anymore because then we could simply go into the data data directory
and directly access the database.
All right.
Okay.
So within the ADB shell, we are not having access because our ADB shell does not have those two custom
permissions, these two.
All right.
So now let's see how we can still access this table based on an SQL injection.
And to be honest, this might be the only use case when SQL injection is useful, because otherwise
we have seen this with the passwords on table in this one.
So we could simply access those data if the content provider has been exported and in most cases the
developer is separating this.
So the developer is creating two databases, one which is being protected so completely, and one which
might be exported to interact with other applications.
But then those data are not that sensitive anymore.
And if you find a flaw in there, it doesn't matter because we cannot access the other database.
All right.
So this is the things we most commonly encounter.
But nevertheless, let's talk about this, because if you have this case, then it might be an absolutely
nice finding.
All right.
So how can we abuse this right now?
Well, if you go back.
And then we've got this very.
And this one over here.
So out of discovery and SQL syntax will be formed.
And this is something I guess we should discuss on the graphic tablet once again.
So I will discuss SQL injection on a very high level.
In case if you're not familiar with this and you want to have an extended version with union blind time
based stack queries and even more error based, error based smoothing.
If you want to have all of them in a separate video, please drop me a message in the comments underneath
this video and I will upload bonus video regarding to SQL injection.
But this is something which would extend this video very heavily right now and therefore, yeah, if
you are interested, I would split this and provide you those information.
But if you're already familiar with this one, it would be super boring for you.
So therefore we just discussed this on a high level.
Okay.
So out of this query right now with these parameters and this one, this one and this one, this one
and this one and scaled syntax will be formed and this one might look like the following select.
And this, by the way, is the URI we are passing to this one and the URI we need to pass is passwords
because this is the table we can access.
Right now, keys is being blocked, so therefore we need to access or provide passwords for this.
Okay.
And then we are having a where clause which can be simply ignored right now because over here those
selection acts and things like this, this would be normally used in an SQL injection.
But over here we can directly define this production part, which means we can directly insert a SQL
syntax into this query, which is absolutely amazing.
So what we could do is the following If we provide a projection, something like this projection and
single keyboard, then we are having select.
Oops.
Yeah, let's write it in this corner.
That's okay select.
Then we've got the single quote in this column from.
And so on, and single quote will interrupt the query.
So the scale syntax is awaiting another single quote somewhere.
Otherwise, this from will be will be inserted into some single quote, which means this might be treated
as some string.
And therefore, if you only having one single quote, then we are getting an error over here because
the single quote is missing.
We are intercepting the original query and we are not closing it right now.
So this will lead to an error.
Let's find this out.
So let's close this.
Okay.
Let me get this graphic template out of the way real quick.
All right.
So how can we apply this protection?
Well, if you're using content and then have a look in the help menu.
But but we have Barry over here and then we've got this projection so we can use the projection to apply
our projection.
If we applying this in the following way.
Then we can see the terminal over here is expecting to to end the string right now.
And exactly the same happens in the SQL syntax.
So if we close this right now, then we are getting an error while selecting from pass.
What's the signal code?
If you are inserting it in this way, it will mess up determinate.
Therefore, we have to use double quotes left and right from the beside the single quote.
So this will now bypass our ADB shell terminal and insert and single quote directly into the SQL syntax.
All right, so let's do this and let's see what happens.
Oh, nice.
Unrecognized token here.
We can see exactly like we have written it down before.
Do we still have it?
Let's see.
Yes.
So here we still have it.
Select and this one.
So here we have opened the query.
And now it's complaining about this path that this one is not being it's not being enclosed.
So we have interrupted your original query.
All right.
How can we use this?
Well, this is now our point where we can apply our own syntax into the original syntax, and afterwards
we just have to fix the original query.
And this can be easily done by applying a comment.
Let me show this to you.
So if we are inserting something like this in the projection, not the single quote anymore, so let's
get rid of the single quote.
If you are now inserting something like this.
From passports, from key.
And we have to take care about key.
So how it's being written correctly so uppercase lowercase and it's not keys.
Keys is the reference in the in the content URI but the table name is key.
And here we have to be precise because we need to address the table name.
We are not within the content provider URI anymore.
Okay.
So if we inject our own SQL syntax, we have to stay or stick to SQL syntax, which means SQL needs
to know the original values.
Okay.
Back to this one.
If we if we are providing protection as from key and then to hyphens, this will comment out the rest,
which will lead to the following syntax.
And so here we are having select.
And now we are inserting all from key, hyphen, hyphen.
And this will lead right now to the following.
So after what we are having, let's see, we are having from passports.
And well.
And so on.
So everything after what will be now commented out.
So this will be simply ignored.
And the only syntax that's going to be executed is this one over here.
So select all from key and this via the password table which can be accessed because this one is not
being protected by the custom user permission.
All righty, let's try this out.
Okay, so let's see.
Over here.
Yes.
And projection all from key.
And this is all 3 to 1.
Yes, I'm missing the hyphen because then now we are having we can see this perfectly select all from
key from passport.
This is not valid as Q syntax.
Therefore we have to comment it out.
It was on purpose, of course.
So let's see.
3 to 1.
Nice.
We've got the password in plaintext and also dependent plaintext.
Amazing.
Right.
So this is how we can circumvent the custom user permission based on an SQL injection.
And to be honest, this is the only use case I can think of an Australian section being useful in our
in our Android app because otherwise we would be able to query this anyway.
Right.
All right.
Nevertheless, I think this could be a pretty amazing attack vector in case if the developer is putting
everything into one single database and providing partial access to this one beside this SPL injection,
we are also having another issue.
And this issue is over here.
So this custom user permission is being defined for the path slash keys, which means if you try to
access this one.
At the beginning, I guess.
Yes.
If you try to access this content during with the path slash keys, then the user permission will be
will be checked.
And in case if we are not having it, our access will be blocked.
But this path has not been defined in and regular expression, which means if we are accessing these
keys in a different way, for example.
Four.
Let's clear this content query over here.
So this is the normal behaviour which gets denial.
Oh, yes.
Dash, dash.
There we go.
Yes.
Access or permission denied.
But what if we accessing it in the following way?
Keys slash, then?
Oh, well, we still get the password.
So if the developer is not providing a regular expression, if the developer tries to block the access
based on slash keys, on an hardcopy, on an hardcoded value, then we might be able to circumvent this.
But to be honest, I am not sure if this is still possible regarding to writing an application like
this and uploading it to the play store.
So Google might deny the upload for this application in the official store, and therefore I would assume
that this doesn't happen often anymore.
In case if you think okay, we can simply use slash keys and slash keys slash as in path.
This doesn't work because we can apply many slashes at the end over here and then we can still access
this.
So the only solution for this one is providing a regular expression and not just checking.
Slash keys.
We should check slash keys and then everything else.
All right.
Okay.
So this is all for the SQL injection part right now.
Now, let's have a look how we can interact with content provider.
So let's see how we can insert delete update.
And we have already seen yes, insert delete and update certain entries in the database because the
syntax is a little bit complex.
Yes.
But once you have seen this, it's also included in a cheat sheet.
It's not that hard anymore to yet to get back on this with the help menu.
All right.
So let's see.
We've got this tables pass.
What's this one over here?
Okay, so let's see how we can insert new values into this one.
So.
Therefore we are using content, so we need to use the help because otherwise this won't be possible.
It's a little bit complex, but we will make this okay here.
We've got content insert and now we've got the stress URI So we have to provide our passwords table
and this user ID I guess can be skipped.
But we skipped this and now we've got this binding and this is important binds a typed value to a column
and is formatted in the following way column, name, type, and then the column value.
So this might look a little bit complex, but if we if we open the pass, what's this one over here,
then let's do this.
We already start with insert for this large table, which is I guess the most complex syntax.
So don't get frustrated afterwards.
It would be way easier.
All right.
So nevertheless, let's do this.
So if you want to insert a new entry and let's see content insert, then we have to provide a URI,
which is this one.
Yes.
I see my typo.
Okay.
And now we have to use this strange bind.
And I guess there's always an example.
Yes.
Here, we've got it.
So this one over here.
Name is the column.
Name.
Type is string.
And then we've got the column value, which is new settings.
Okay.
So if you want to insert a new entry, we have to do it in the following way.
Underscore ID this one cannot be used because this one is the it's the index and it's primary key and
it will be auto incremented.
So this can be skipped, but then a new service has to be entered.
So our service is the column name.
Then we have to define the type which is string, and then we have to define the value, which is the
new value we want to insert in this case hat.
Okay, then.
Let's see.
We want to define a new username.
String and the user name is leaked and then we want to define a new password.
Now it's getting interesting.
I guess it's B for byte, but I'm not sure.
And we provide zero.
And then B, I'm not sure about this one.
Maybe I have to I have to look this up later on.
But let let's try this first.
Okay.
Then we have to use email column nine with the value string and this is hacked at least.
All right.
Let's see if this one works.
So let's enter this in 3 to 1.
We are not getting an error, which is good, I guess, to verify if this works.
Let's compare this once again.
Yes.
Nice.
So we can see.
Yes.
We have inserted a new entry.
That's.
Unfortunately it might not be helpful because this password is binary data and if it's being encrypted
and it cannot be decrypted when we are locking in because it's not valid encryption, then we will get
an error.
Nevertheless, let's see if we can set this password to be empty.
Maybe then it might work.
So this could be also on way to entering the application.
And let's see to to update this password.
We can.
So if you want to change the password, we have to use a new query, which is the update query, which
is pretty good because that's why we are here.
So content update.
Let's see how update is being used over here.
Okay.
Once again, we have to apply the URI.
Oops, the complete URI.
Okay.
And let's see.
Update.
Update is nice because we have in our statement and we've got our bind, bind once again column name,
type, new venue.
So Bind is the current name, which is our password.
D type is B and we are not applying any value.
I hope this works in this way.
So if you are not applying any value, I hope it's not okay.
And then we have to define which query we want to update, sorry, which column.
Therefore we have to square statement until we have it.
Okay, let's copy this OC and now pass what are not possible.
This might be too risky.
Let's say where a d is equal to.
So this is our role ID, too.
And now we want to update the password in there.
With a new bite value, which is nothing.
I'm not sure if this works.
Let's see.
3 to 1.
No arrows.
Let's carry it once again.
So it seems to not work, unfortunately.
It might be that updating the password in this way, we have to provide a new value.
So to figure this out, let's let's change another thing.
So let's change this service, which is in string, and we want to change it in this part.
So that's the column name.
And now it has the value.
Hecht And we name that Hecht again, and we want to change the service, which has the name Hecht already,
this one.
So let's see where service equals.
Hecht.
And so this should definitely work.
I'm pretty sure it works in this way.
Let's see.
OC content update a 3 to 1.
No error.
But I mean, we we didn't get any errors so far.
Yes.
It is a problem with the password and the byte value because we we can see we have changed the name.
We can also change the name of the first account which we do not have access.
So service.
But can't Hecht read the name?
So now we want to change the banking name.
All right, let's see.
Yes, it has been changed.
So let's look in into this application and verify this.
So here we have the app input text and I hope it was this password.
Let's see.
Yes.
Oh, nice.
We have created two.
So.
This is interesting.
Here we can see a count Hecht and Hecht again.
So we can modify existing data in there, which is, I guess not good because yeah.
Even if the password is being encrypted, we might be able to apply some null value.
I will check this out and provide this in the cheat sheet if there's a solution for this one.
So by by inserting a new account, we might be able to to bypass this one over here.
Oh, yes.
I realize right now, even if we could insert a new account, this password is different.
So that's not the password of the application.
It's the password of the password.
Safe.
So sorry for this.
I got confused by having those two tables with the same entry.
My fault.
Okay.
So even if we could create a new account, we cannot circumvent the log in screen because the logging
screen is being defined in the keys table, not within the password table.
All right.
Okay.
Not to confuse you, but to sum this up correctly.
I mean, we could use our keys bypass to circumvent the logging screen.
And this is exactly what we're doing over here.
So I have added this sequence right now.
We simply check what entries are in our key table by using the bypass.
And then we we can update or also insert new one.
In this case, we simply insert a new entry.
And then it's a little bit interesting because there's only one entry for this whole application because
we cannot have multiple users, which means we are now having to increase, but we can see the password
which we have entered may be used to log in into this application, but if we can tamper with the key
stable, then I mean, yes, we could simply read out the original password and log in into this.
Therefore I haven't counted as an S in lock in bypass at the beginning right now and I still won't do
this.
Okay.
So reading out the password then, I mean, we do not need to bypass this by entering or updating the
old entries.
Alrighty.
I'm perfect.
Okay.
Last but not least, we've got this content delete.
Why do we have it?
This one.
Content delete.
So how does this work?
Okay, we just have to provide the word statement.
Okay, this is easy.
Let's get back to passwords.
Okay.
Now let's delete, for example, the second entry, this one over here, content and then.
Delete urine.
Then we have to provide this in this urine.
And I guess we need to be careful if you hit enter.
I'm not sure if you delete everything in there could be possible.
Now let's see where.
So content delete and then we simply copy paste this one.
Okay.
Well, and now we need to identify this database entry.
So, yes.
Where service.
Service is.
Hecht again.
Och.
It should disappear, I guess.
Maybe we have to refresh this view.
So if you go into settings, maybe and back.
Yes.
You can see it has been deleted.
All right.
I guess I missed clicked.
Yes, I guess I missed.
Click.
So we have seen how a SQL injection works with content providers.
We have seen how we can insert update and delete entries, and we have also seen that we should provide
an regular expression over here.
What we have not seen is a B using this part right now.
And I guess, yes, let's do this in a very quick bonus video afterwards.
So then we will write an own application which grants the permission over here and then simply access
those keys.
All right.
Okay.
In case of any questions, feel free to drop some comments underneath this video.
And otherwise, I'm looking forward to see you in the second part of this video where we exploit this
with our own malicious application.
So see you there.