All right, guys.
Welcome back.
One thing we haven't talked about so far is empathic commercial attack within a condom provider.
And then we are done with our content providers.
So we have seen an SQL injection and now the part which is missing is impact traversal attack.
So this week we will find out how to exploit this and most importantly, how to identify this type of
attack in a mobile application.
Are you that excited?
Like I am right now?
Then let's go.
All right, here we are back at Ubuntu VM and I have prepared a really nice application where we can
train this path traversal vulnerability.
So as always, you can find this as an attachment of this section.
And yeah, I have included the whole source code.
So therefore let's simply download it, import it into the Android studio and have look into this one.
Alrighty.
So I have already downloaded it.
Therefore I only need to start this.
So I start the android studio running the bash studio stage script.
Here we go.
All right, here we've got the main, the welcome screen.
And let's see to import this project, all we need to do is simply clicking on import project and then
we are selecting this amazing music player.
APK So let's do this.
Okay.
Let's finish.
Oh, it's already finished.
Nice.
No, no.
Tip of the day.
Okay, so the first thing I like to do when analyzing a mobile application is having a look in the manifest,
because then we get a good overview of what's going on.
So let's do this Android manifest and here we have it so we can see we're using a permission rate external
storage.
All right.
This is something we have to look for.
Then we've got our application tech, nothing too fancy in here.
And then we've gotten provider.
So here we've got the content provider and this one is being defined in this class.
All right, here we've got the authority name enabled through, export it through.
All right.
So this content provider has been exported through.
So this content provider is available to the outside world, which means we can interact with this one
based on another application or within the within the ADB shell.
All right.
We do not know right now if we are interacting with the database or with some files.
We will find this out by analyzing the code inside this this Java class.
But for now, let's keep it this way.
So we know we've got a content provider and it's being exported.
Then we've got an activity, our main activity, our well-known content filter.
So this is our entry point.
It's listening for our click on the icon to get started and then we end up there.
All right.
So far, so good.
Before we analyze this code further, I would suggest let's have a look into this application, because
I've gotten a feeling that this one isn't really amazing one.
So let's see.
We've got our emulator.
I have already started it.
And to install this application, all we need to do is hitting this fancy.
Run a button over there.
Let's do this.
And let's keep this over here.
OC Degradable is now running in the background.
Afterwards, the application will be built and transferred to the smartphone via ADB and automatically
being started.
So all of this happens magically in the background and.
There we go.
That's this look absolutely amazing.
Yes.
No, it doesn't.
But let's see if the functionality is given because I mean, that's the most important point.
Right.
So let's turn up the volume already, already max volume.
So let's see, we've got music player and you've gotten play and stop buttons.
So let's see.
Cannot hear anything.
No.
Yes.
This is absolutely chilling, relaxing music, ideal for for checking applications based on a path towards
vulnerability.
Absolutely amazing.
So I really want to thank the the author or the musician, I would say for for the strength because
it's being provided and that license which can be used in costs like this.
So he had the credits for the outdoor release.
Thank you.
All right.
Back to this one.
So we've got a really nice music player and I've got also a little feature in there.
But first, let's see if this functionality works.
Yes, music is stopped.
Okay, so now we've got some kind of mixing application because if you hit the play button, then this
this relaxing music starts once again.
And now we can we can play it multiple times.
For example, I need to hit the timing.
Okay.
Completely missed.
It doesn't matter.
Let's.
Let's keep doing it.
Okay.
So it's absolutely horrible.
And it stop doesn't work.
Amazing.
So let's close this really quick.
All right.
So I yes, I have prepared it, of course, in this way that we can do this to make it a little bit
more interesting.
So now you've got music application, and if you become one some great teacher, then please give me
some credits back on this video over here.
All righty.
Perfect.
Okay, so for now, we know what this application is doing, at least yet the main purpose.
But let's figure out what's exactly doing.
And therefore, I would suggest let's go into the main activity, because this is our our entry point.
So main activity and let's see.
So we've got contacts, media player.
I mean, we haven't talked about this one, but we can guess what this one is doing.
Our own create method, text view contacts, nothing too fancy.
Oh, what's this create secret file the sounds.
This sounds interesting.
Let's see here we've got start and stop music.
This might be those functions connected to the button.
And yes, you can see this is not in programming mistake.
I did this on purpose.
All right.
Okay.
I mean, the stop function, this is something I have messed up, but, yeah, that's that's that's
okay.
So back to this one.
We've got create secret files.
So what is this doing?
We've got two strings.
This might be the file name and there's the content.
Okay, then we've got on file output stream.
I mean, we do not know what this one is doing, but hey, okay, we've got an open file output.
So what?
Let's get this out of the way.
So maybe we are opening this file, my secret file name over here in the context private mode.
And then it seems like we are writing this content to this file, so we are simply creating and file.
And the amazing thing right now is this file is being stored in the protected data data directory of
this application.
So this is within the sandbox like the share preferences for example, which means a normal user cannot
access it.
Right.
Let's verify this.
So let's make our ADB shell connection.
And then let's see, we have to get real religious.
We were tested afterwards without.
So then we have to go into data.
Data.
Then the package name.
What's the package name?
Let's see.
Let's keep this in foreground.
And this is the package name.
And then we've got directories, case code and files.
So let's go into files.
And here we have my secret file.
Yes.
Let's check the permissions of this file.
And this user or higher privileged users are able to access this file.
All right, let's print it out.
Is there something in there?
Yes.
This is my super secret text that no one should read.
All right?
I mean, this text has been included in the Java source code.
So at least after talking about reverse engineering an application, we would be able to read this,
but let's say it store some user credentials.
So there might be some initial credentials.
Okay, but afterwards the user provides a new password and the password gets updated in this file.
Then we are not able to fetch this information based on the source code.
All right.
So now we need to make sure that really only this user of a higher privileged one can access this.
Therefore, we leave the root context and we're printing it out.
Whoops, printing it out once again.
Let's see.
Permission denied.
Perfect.
So this is exactly like it should work.
We've gotten file context more private.
It's being stored in the in the internal sandbox app directory and no one else.
This application and higher privilege can read this, but no third party apps right now.
Okay.
All right.
So this is the whole functionality of this main activity.
It's creating an.
And fine.
And it has two buttons.
So the interesting part right now is there's absolutely no other interaction.
So we do not access our content provider in there.
Which raises the question, do we still have invulnerability?
I mean, we are not using this code, but before we talk about this, let's first have a look into this
content provider.
So here we've got the music file provider class and this one is extending this content provider.
And here we have node methods.
Most of them are not being implemented.
So there are those two rules.
Please implement this stuff.
We've got an delete get type insert on create query and some other stuff.
Yes, update.
This looks like our database, the action, but it seems like we're not having a database interaction
action.
But what we have is this personify fight.
What about this means open file?
So this one is also in an overridden method, which means this one has been defined in this content
provider.
So now we are not dealing with a database anymore.
We are dealing with file access.
Content provider means providing content beside databases.
We can also provide access to and file.
Amazing, right?
Absolutely.
And here we can see we've got this open file.
This one is now taking two arguments and URI and mode.
The URI seems to be the file path because we can see we are creating a new file object based on this
URI and then let's see.
Has this been used over here?
This one is being used here and we are opening this file right now and we can see this mode.
I mean, it might be read, write, append.
Not sure if append exists, but this mode is simply what type of access we want to have to this file,
read or write.
In this case, whatever we provide in this open file method, which is, by the way, exported to the
outside world, so we can interact with this one, we can provide those two parameters, but this parameter,
at least the small parameter, is not being used.
Even if we say we want to write to this file, it's not working because we've got it hardcoded over
here and read only.
But let's do it.
Not that quick right now.
So here we are opening this file and it's being read only.
And then we are returning back this path file descriptor.
So this one is simply trusting the script to this file.
So it's some kind of, let's call it access to this file.
I do not want to go too deep into the Linux system right now because it's not relevant.
So we've got file descriptor and sockets, but at the end, I mean what this means is we are getting
access to and file so we can interact with in file and this file we can interact with is being opened
over here and it's being referenced via the theory.
So we provide and file.
We want to open to this content provider and this content provider is opening this file and providing
us access to it.
Okay.
And use case could be, for example, sending a music file to this type of application, the content
providers opening it.
And yeah, within the return function over here, it could also now put this into a music stream and
start playing it, for example.
But to make this as simple as possible, I have included only the necessary parts.
So the bare minimum to make this content provider working and vulnerable to our type of attack.
I mean, if you find now this use case and export content provider with this parser file description,
open file URI and this URI is directly passed into an file which is being opened over here, then we've
got our vulnerability.
You do not see right now which one?
No problem.
We will discuss this extensively right now.
All right.
Okay.
So therefore, let's get on the graphic tablet and yeah, let's see, I make a little bit of space and
now let's let's directly write this over here.
Okay?
So let's see, we've got our application.
This one, this is our music player.
Let's make the screen.
And this one is now exporting this music file provider, which is in content provider and this one is
exported, which means in this method is available from the outside world.
Okay.
So we can interact with this method.
This method is now taking two parameters and URI and mode.
So the first question is, what is this URI?
The URI is simply just in reference to in fine and it looks like the following.
So if you want to reference file, we can do this in the following way.
Content this is our scheme.
Then we've got the authority name I yeah, I just name this and right now and then we've got define
name.
So in case if you want to open, for example, something on the SD card, I guess it looks like the
following content.
Slash slash our authority name and then SD card.
Music thought dot MP three to access this file.
It's based on the SD card.
I mean, we have to use this read external storage permission, but this app has this permission, so
this would be fine.
All right.
Okay.
So now the question, how can we exploit this?
Well, if we now having this application or a third party application of a malicious attacking app,
then we can now provide and file which this application is going to be open in this one over here.
And instead of using the MP three file from the SDCARD, we can provide, let's say, whatever we like.
But of course this app needs to have the permission to open this.
So what if we are not providing the SD card and P three file?
What if we are providing something like content slash slash, then our authority name and then access
to this.
My secret file.
Then this application is taking this URI.
It's assigning this to a new file.
It's opening this file, and it's providing back an access to this file within this parcel file descriptor.
So we send this to this application, and this application is now turning back.
In this file descriptor, this parser file descriptor, let's say it's simply access to this file.
And now there's this clue because the my secret file in this one over here, I have it's it's an underscore
not and nothing else.
So let's let's clean this.
There we go.
So now we've got an underscore this.
My secret file is being stored in the data data directory of this application.
So this one, let's let's take another color that's not visible.
Let's take this one.
So this one has an air in storage in our smartphone data.
Data, and then the package name.
And then we've got files, and then we've got my secret file.
So this one is being stored in the protected data data directory of this package.
Which means if our application tries to access this file, we have seen this in the ADB shell with cut
access is being blocked because this user ID has not access to access.
This has no permission to access this file.
All right.
But now if we ask this application, so we we are asking that stratus once again to make this more dramatic.
We asking this application over here to open this file by this method.
Then what's happening is this application has access to this file because it's being stored in this
in this internal directory.
And this user ID, of course, has access to open this file.
And now this application is opening this file and providing back access to this for our application.
So this one here will be now provided back in access based on this parcel five Scripture.
All right.
Okay.
If not, don't worry.
We will discuss this now once again regarding to the type of attack.
And then we we will do some practical exercises regarding to this.
All right.
So here we got this application, and here we've got our application.
So now we know we can interact with this content provider and we want to send in file access request,
for example, this open file here.
All right.
So we can define the URI.
And now to exploit this path traversal vulnerability, we have to do it in the following way.
I mean, we've got multiple options, but I show you one option right now that works all the time,
and therefore you only need to remember this one and not the other parts.
All right.
Okay.
So the problem right now is if you want to open this file, this my secret file, so we would have to
provide the following path content.
It's less.
Less than our authority name and then files and then my secret file.
We do not know the context of our file access.
So this one, this URI here might present some additional stuff.
For example, it could say instead of accessing or passing this URI directly to our application, it
could append another directory first.
In our application, we've got three directory.
So far we've got cache.
We've got something else I do not remember anymore and we've got this files directory.
Now let's say this application code has been designed that this one is the, it's the base directory.
And if we now append in this part, the application tries to access this files directory in this cache
directory and within that is my secret file, which is of course not available
because this one does my secret file is being stored over here.
So we are now opening or trying to open a file in the cache directory.
But this file doesn't exist because we have this we have within the cache the context over here, let's
call it context.
So the application starts opening and file under this directory.
So on the first view, it seems like we cannot access any other files besides those files in this case
directory, right?
No, of course not.
Because what we are doing right now is in path traversal attack, which means instead of providing files,
my secret file, what we can do if we are in this cache directory context, we could simply append in
between those two.
Oh, it's getting a little bit messy, but I guess it's okay.
Dot, dot, slash.
It's too messy.
Let's rewrite this what this dot dot slash is doing.
If are now in this cache context over here we are getting back one directory.
So we we are going back one directory which means we are now in the root directory of this application
and now we are entering the files directory and this is now available because the files is over here
and now we have left this cache context.
We are now in the files and we can open this my secret file over here.
So this would work.
Ask by providing a dot dot slash.
Now we do not know in which context we are, and to provide you an solution that works all the time.
What we can do is providing many dot dot slash attempts, which means we want to woops, we want to
go back to a state where we know how the structure looks like and state how far we want to go back is
the root directory.
So if we are in the root directory of the smartphone, then we know we've got an data directory and
this one has another data directory.
This one has now this package directory.
So the package name and this one right now has this files directory.
And in there we've got this my secret file.
So if we go back or if we have the ability to, to go back to the root directory, then we can we can
always apply this scheme because this never changes based on the root directory.
All right.
Okay.
So how many total slashes do we need to go back to the root directory?
The answer is we do not know this because we could be in this directory or we could be in subdirectory
or even further.
But that's not a problem, because once we have reached the root directory, we cannot go further back
behind this root directory because that's the that's the starting point.
So we cannot go further back, which means we can apply as many dot dot slashes as we want.
We just need to have enough to get out of every single subdirectory that we might be in right now to
go back to the root index.
And then we can follow along our path over here, this one.
So this is how an path traversal attack can be easily exploited without having to worry about who where
we are right now.
What is the structure?
Do I have to go one directory, back or forward and things like this?
All righty.
Okay.
So therefore, I would suggest let's simply do this.
Let's try this out.
So our attacking vector, let's clean this up a little bit.
Okay.
So our attacking vector would be would be something like this content, slash, slash, then the authority
name and then dot, dot, dot, dot, slash, and so on.
Another one, just one for good luck, this one and last one.
This is really the last one.
And then we append our files and then there's my secret file.
All right.
This is the content we are providing from our application to this application and nicely asking, Hey,
please open your secret file for us and provide us access to this.
You might ask right now, why is someone developing something like this?
But there are tons of really good use cases to do this.
I mean, not in this way.
Of course, the mitigation would be simply filtering this part over here, this URI.
But if this is not being filtered and we can directly provide our parameter, enter this one, then
we can access those, those private files.
And this happens quite often still.
Nowadays, there were a couple of really, really insecure path proposals that lead to huge security
risks of those applications.
I mean, imagine how many sensitive data are being stored in the shared preferences or databases or
things like this.
We can access all of them if we are having this type of vulnerability.
Amazing.
Right?
So therefore, let's do this.
How can we how can we send this file right now?
And once again, we do this in the ADB shell and then we write our own custom application to perform
this task.
You're ready for this, then let's go.
Okay, so first, let's clean this up, all right?
And let's also get this a little bit further that we've got access to those things.
Okay.
And I would suggest let's open this application in the background.
I mean, it's is it required to be open?
I'm not sure.
I guess not.
We we can we can try this out later on.
But I really like this, this chillout music.
And yeah, I guess we can play it because it's license free.
So therefore let's play this music in the background.
All right.
So now we've got some relaxing music to to exploit this right now.
Okay.
Volume down.
Okay, cool.
So if you want to interact with this condom provider, we need our ADB shell first.
And then what we need to use is content.
And if you remember, I'm not sure if you can still hear it, but for me, it's fine right now.
Okay, maybe.
Maybe one volume up.
There we go.
This would be absolutely perfect.
So, yes, here we've got our our condom provider help.
And we have talked about this that we have split it into two paths.
I guess we did split it over here, but.
And this one might be.
I'm not sure this one might be.
Yeah, I guess we should split it up this way.
This is file related, and this one here is database related, this help path.
Okay, so this means we can focus on this one and I mean, we've got ADB shell content read Uri.
Well, it's it that easy.
Let's find out.
We've got read Uri.
Right Uri and get type.
I guess this is regarding to meter types.
Not sure about this one, but yes.
So I would suggest let's see, let's clean this up.
Okay.
If we now want to open file.
So I mean, what we have to do is content read and providing the URI.
All right.
What is the URI?
Well, it starts with content so that the content provider knows this is regarding to the content provider
or this application knows this is regarding to the exported content provider.
And to say that it is for exactly this one, we have to provide the authority name this one.
And then we have to provide the file we want to open.
So we have seen our my secret file both on the files.
My secret file.
I guess this will work because we start maybe at the application directory.
So let's see.
Nope.
It doesn't work, which is good.
Which means we are not sure in which context we are right now.
So therefore we we didn't hit this file, but we know the file structure behind this.
So let's go back to the root directory and then follow along our path.
All right.
So to do this, yes, let's first make sure that we are hitting the root directory.
So we are applying lots of dot dot slashes.
It doesn't matter the amount, it just needs to be enough to get back to the root directory.
So it could be three or it could be 15.
We have to try this out, but we cannot make too much right now.
So therefore let's add some additional ones.
Okay, so now let's open another shell and let's verify this.
So we are getting root privileges now we are hitting the root directory and then you're following along
this path.
So data, data and now this package name com packing music player.
Then we've got files and here we've got my secret file.
So this one is the path from the root directory.
And then we just need to open this my secret file.
All right, let's see if this works.
I hit this in 3 to 1.
Yes.
This is my super secret text that no one should read.
Then typo?
No.
Okay, perfect.
I mean, this is how we can access arbitrary files in this application.
Amazing.
Right?
So, yeah.
I mean, this is how to exploit an and path traversal vulnerability.
The things we have to look for is, oh, let's see, let's play once again because it worked absolutely
smooth based on this one.
So the things we have to look for is and provider which is exported to true and which has this method
B defined this parcel file descriptor open file.
And the theory is not being filtered.
If this is the case exporter, content provider, open file, unfiltered URI, then we've got path traversal
vulnerability.
Amazing.
Right?
So let's see how we can exploit this from our own application because I mean, having this an ADB shell,
it's well enough to show this application is vulnerable to this type of attack and you do not need further
proof.
But in case if you have customers, then it would be absolutely amazing showing secrets, passports,
databases in your application, right?
Absolutely.
I mean, we also do not have to get physical access because we can do this remotely with HTTPS requests
and things like this.
But I guess an and demonstration app where it opens those files in our own application, this should
be well enough.
All right, let's do this.
I'm super excited about this.
Oh, still super excited because the code is not really much.
So this just takes a few minutes for me.
Maybe many minutes, but I do not want to extend this unnecessarily long.
So let's create.
Woops.
So let's create a new project.
Okay.
We choose empty activity.
And then we named this.
How do we name this
path traversal?
Puck.
Yes.
I choose language trauma minimum estimate.
This one I click finish.
Turn down the volume a little bit.
It's getting too excited right now.
All right.
The bid process has been finished here.
We've got our own create method.
So how can we now perform the same task in this one?
Not this one.
This one.
So.
No, this one also not.
I hope I've got it somewhere opened.
Okay then let's do this really quick.
So ADB shell content, read URI content and I've got it.
Maybe in the clipboard.
Yes.
Looks good.
That's on one slash too much.
All right.
Yes, this is working.
Perfect.
So this is the file or this is the content request, this URI request we want to send to this application.
Okay, so how can we do this?
Well, once again, we have to define our groups.
Sorry, our content resource.
And we can do this with the get content resolver and then we've got an open input stream.
Yes.
So this one is asking for an URI.
Therefore, let's define this URI.
And we have already seen this so we can do this.
So your URI new URI object and then Uri thought pass and this.
Yes.
What's this one?
Returning.
Let's see.
It needs to be surrounded with crime.
Catch, because file access can go wrong.
And what does this one returning?
Can we.
Can we see this?
Then I do it this way.
Then we get an error.
Because what's the return value input screen?
Okay, so this one is returning an input stream.
Input stream OC.
Let's name that in this way.
And yes, this is already doing odd magic.
So we are asking why this get content resolver, open input screen.
We want to have an stream to this URI and we are passing now our path traversal attack to this application
which gives us back and stream to this file.
All right, so now the question, how can we print this out?
And to be honest, well, this is very deep in the Android programming.
I try to show this on a high level and then explain how we can print this out.
All right.
So just on a high level and we do not go deep into this one, so let's get back on the graphic template.
Okay.
So to print out an input stream, let's see what's happening.
So we've got our file and this one is now returning back.
This part here.
This is our input stream to this file.
And this one is, of course, not simply just in spring, because it's some kind of stream.
So we need to get to fetch data from this stream.
Okay.
What we need to do is we need to do the following.
I guess I'm also not 100% sure.
Let's say we are we are filtering this or we are accessing this based on an input reader.
So we need an input reader in front of this.
Okay.
Then we've got here and Rita, which can read the stuff which is going from the input stream to us.
So in this direction, this is our app here and this one is the other application which is providing
this stuff.
And then in the input reader, I guess it's in buffer reader in case I it's not this as it read buffer
buffer reader read buffer rip buffer maybe it's this way, read buffer.
Otherwise we will look this up and this one can now read certain parts out of the screen, for example,
1024 bytes all the time, and those bytes can then be transferred into a string and we can append our
spring.
And we need to we need to keep reading from this from the stream until we are not getting any data anymore.
So if these are our data, until the stream is not returning anything, then we know we are at the end
right now.
All right.
Yes, this sounds absolutely complex, but I guess these are just two or three lines and a wide loop.
But we will we will find this out right now.
So let's see.
By the way.
Yes, this is not an app development course.
So in case if this is now too much for you, lean back, relax, turn up the volume of the music and
then just watch me doing this in case if you want to have reference application.
So if in case if you want to show one customer, hey, this is how we can exploit the path to a virtual
vulnerability and show the data and our own application.
Simply copy paste this code.
Ben It works.
So if it works, then you can you can freely use this, of course.
And you do not have to go through this.
Well, let's say even understand it completely.
But it's good if you have an and basic knowledge about this.
All right.
Okay.
So here we've got now our input stream, which means we now need our input stream reader.
We need someone who who understands what's going back.
Input screen reader
and this one.
Let's see, we can, I guess, supplied this part.
Yes.
The input stream has been defined in this try and catch block, which means if we are getting an exception
over here, this variable is unknown for this part.
Cannot resolve this symbol.
Exactly.
Which means we simply create an variable over here.
Then this application is aware of this and we make sure with our try and catch block that everything
works fine before.
Okay, now we've got the input stream reader.
Now we need to read this stuff and we need to keep reading until we're not receiving any data anymore.
And this can be done within a wild loop.
So while that's a good beginning, but now the question we need is this condition when we are not receiving
any data mare and I guess this being done with buffer reader let's see, how does this read buffer read
buffer reader buffer reader this way, buffer it, read a sorry, now we've got it.
Okay, but we need to assign this buffer reader first and we can do this over here.
So we are creating a new object buffer reader and this new buffer reader.
Whoops.
So we are now reading from this input stream reader our signal buffers and now we've got this condition
buffer reader And ready.
Yes, ready.
Sounds a little bit misleading, but this also means if it can be used as one condition, if you're
not receiving any data anymore, and it's also making sure that we can access further data so our reading
might be blocked during the read, but let's do not go too deep into this.
So this is our condition and we've got an error over here.
Let's see.
Surround surrounded with try and catch.
Well, okay.
I'm not sure if I like this code right now.
So we've gotten by.
True.
And we exit our watch.
No, no, no, no, no.
Mm hmm.
Let's make this different.
So.
Okay, let's get this trip.
Log over here.
And then let's take our puffer reader as a condition.
And let's see as this.
Here.
We've got our try.
Oh, there's this bracket missing.
Yes.
Okay, now it's good.
So, I mean, I'm not an encoder, but even this part was.
No, this was nothing I would like to go for.
Okay.
So now we are reading our our stuff with this buffer reader and we can assign this now to our string.
So we are defining a new string.
This is the file input.
I also do not like.
In this way.
So now we can use this file input plus equal and now buffer reader read line.
Yes.
Okay.
So now we are reading one line out of our file and we are assigning it to our string to our file input
string.
But the problem is right now, this read line ends at the new line character.
And if we are reading this line, it will append everything in one line right now.
So if our file has ten lines, our string over here will have everything concatenated together right
now, which is not really readable.
So therefore, after this read line, we are pending a new line because then we know the line has been
ended as thus so far.
Okay.
So in case if we are having ten lines, our string would put everything into one line.
But after reading one line right now out of our ten lines, we are pending a new line in our string,
which means our string gets also split up that we've got this nice format.
Yes.
And this is everything we need to do.
Yes.
Okay.
I mean, printing it out, System.out.println, and then we are good to go.
What's the problem?
System.out.println.
I'm out of this function, maybe.
Oh, yes, I'm out of this function.
Sorry.
Okay, we need to put that over here.
All right.
Now.
We're good to go.
The only thing we are missing right now is if you want to use this code on modern smartphones, on Android
11 and higher, because then we have to deal with those privacy settings, which means even if this
content provider is being exported, we are not able to interact with this until this application is
visible for us.
We as net taker, we do not care about this because of course we want to be visible for it to fetch
all the data.
I mean, we we do not have any problems with this.
The application might, but in our application, everything is fine.
All right.
So therefore we go into the manifest and then queries, oh, let's see.
Not sure package.
And then there there is android name who is I wouldn't remember this and we we could simply look this
up but having it in this way is better.
So we need to have this package name this one.
And that's all this should work right now.
So our application should be able to fetch the secret file out of the other one.
Let's see.
So let's run this and then we test if the application has to be in foreground, because I'm really not
sure about this one.
This this will be interesting also for me.
So our application starts in just a moment.
But lab.
There.
I can already see it.
I have seen it system out.
This is my super secret text that no one should be read.
Amazing.
Right?
So this is within our own application, the path to version vulnerability.
And you know what?
Let's print this text out over here.
So let's print it out directly on the screen and let's apply our hagfish scheme.
I mean, this is absolutely not relevant anymore and you can feel free to skip this right now, but
I would suggest we do this really quick.
It just takes a few minutes.
Okay.
So what we need to do is we need to go into our activity main exam layout within code and then I mean,
we've got this hello world text view.
So let's make a default text hacking in progress.
Okay, then let's make the whole background flag that it looks absolutely zero.
So lead so android background color, black.
Okay.
And let's make this text kind of green.
I mean, it's not even close being green, but I do not know the the English term for this one.
So let's make this teal.
I'm not sure.
Okay.
And maybe adjusting the size.
14 DPI and also let's, let's put it a little bit away from the left that it's not fitting directly
at the screen.
So let's apply an padding of 20 or I'm not sure if this is too much.
Let's see.
Hmm.
For this text.
It's okay, but let's see how it how it works.
Okay.
So then we need an ID for our text view to address this in our main activity.
So we need to assign a new ID, add plus ID and rename the assembly text view like always.
And then this is all we need to do.
We have assigned an ID, we make this absolutely looking hek ish and the only thing we need to do right
now is going into the main activity and assign this one.
So over here we are creating a new text view.
So we are having in text view in our application and now we are assigning this text view.
So this text view, I keep this typecasting even if it's it's not common anymore.
So that's the way I am doing this.
Okay.
So now we need to find this ID and assign this text view which has been defined in our layout, which
is available in the on create method to this text view.
And this is easy to find view by id, r dot, id, dot, and then this name and then instead of system
out, we are simply setting this text of this view, set text and we are done.
That's all.
Let's run this and let's see how what amazing hackers we are.
This is the wrong.
Okay, there we go.
Oh, this action bar.
This is my super secret text that no one should read.
All right, amazing.
Right?
I mean, we can also friend accessing my secret file, and then we can make it a little bit ugly.
But, I mean, it's okay.
So let's get also rid of this action.
But because this is looking awful, this can be done in the theme in the Android manifest theme.
So there we go into a theme.
And then in this final action bar, I mean, index also in dark, I guess.
Okay.
But let's let's really stick to this one.
Let's see.
Okay.
Our app is being loaded and.
There we have it.
It could be a little bit more pretty.
But I mean, as a demonstration, it's enough, right?
So we can see within our application we are accessing this file.
And you think I really would like to test if this is working, if the app has not been opened?
To be honest, I guess it is because within our intent folder B we did get this error message that running
in background task is not allowed, but this seems like not to be in background tasks.
So let's see.
Oh, I really need to apply some icons, otherwise it's getting a little bit annoying.
This one path progression.
So this app has been closed.
Let's see.
Is it still working?
Fingers crossed.
Amazing.
It's still working.
So we can access this file any time as often as we want.
It's this cool.
It's absolutely nice.
All righty.
So this is all for this video.
Once again, it did become a little bit long.
But yes, I mean, the things we have seen over here are pretty amazing.
And this is something which still works also in part bounty programs, because this type of attack is
absolutely critical.
And many people do not look for for those type of vulnerabilities in mobile applications.
So if you want to do some bug bounty program on this one, also have a look at the reversing section
that we will talk about mass day, compiling applications.
And then I hope you earn a lot of money.
All righty.
So next, we have some practical exercise.
So the C application has exactly this type of vulnerability in there.
And this is something you can practice on your own if you like to.
So the task would be try to identify the path traversal vulnerability and try to exploit this.
I mean, I'm not sure.
Yes.
So for example, the preferences should be readable.
I'm not sure what type of output we get if we want to try to access this database.
But to be honest, I think this should also work.
It might look a little bit cheaper ish, but yeah, the text should be there.
So try to exploit this in the C application to get back the passports or the database.
Alrighty.
So good luck and have fun.