- Hello, and welcome to the Android Security and Exploitation course
by Pentester Academy. I am Aditya, and I am your course instructor for this entire
training series. So in the previous video, we had a look at some of the access
control issues. In this video we are going to have a look at another type of access
control issue which is related to content provider. Now, in the Android Security
for Pentesters course, we have already tested a lot of different
content provider-based vulnerabilities and exploitation using Drozer. And this
particular vulnerability is the exact same thing of what we did in the Catch Notes
application in the Android Security for Pentesters course. So I highly recommend
you to go watch those videos and come back and try out this exercise. So let me open
the "DIVA" application and go to the "Access Control Issues - Part 3". So the
objective of this particular exercise is to set up a PIN and then create several
private notes and try to access the private note from outside the application
without knowing the PIN, right? So let's set up a PIN over here, and for this
example, let's set it up as 1234. So "PIN created successfully. Private notes
are now protected by you PIN." And now I'll go to Private Notes, type in
1234, and these are the different notes which are there in the private storage. So
the first thing which we have to do is launch our Drozer in order to find out the
different content providers. Also we have discuss a lot of
Drozer-related content in the past, so feel free to check out those videos as
well. So I'll start up Drozer here. And we're going to
"app.provider.finduri" and put in the package name, which is
"jakhar.aseem.diva". So this particular command actually finds all the different
content providers stored in the application. And if you notice, this is
the content provider, which is related to notes. So it's
"jakhar.aseem.diva.provider.notesprovider/ notes/". And all we need to do in order
to access it is "app.provider.query --uri" and the content URI. And just for better
formatting, we'll add a "--verticle" as well. There's no "--uri" on this one. And
if you notice over here, we get the entire data, which is stored in the private notes
section. And we got all of this without even asking for a PIN, or without even
entering a PIN. Now you can try out the same thing using "adb shell content
query--uri" and parsing in the content URI. So instead of Drozer if you want to
to do it with "adb shell" you can do it as well. Shell, content query, and the
content URI. And you see all the data over here. So even though it is protected in
the application, the content provider in itself is vulnerable. And we can confirm
it by just looking at the Android manifest.
So if we look at the Android manifest, so for provider. So if you notice over here,
it is "exported='true'" and that is the reason why this is vulnerable. So in order
to ensure that your content providers are secure, you can either set it to false,
or you can add the required permission for this particular content provider. So
that's all for this short video, and if you have any feedback or queries, I'll be
more than happy to hear it. You can reach out to me @adi1391 or you can over email
at adi@attify.com. You can check out the certification at securitytube-traning.com
or the subscription model with PentesterAcademy.com. See you in the next
video.