Okay.
This is exactly the point where we did stop right now and now let's have a look into the content provider.
So what can we do with this one?
Okay, let's close this.
And then let's see.
Content provider, this one over here.
So we've got this Trek user content provider and has been exported through, which means it's accessible
from the outside world.
This is our authority name and I guess it's exactly the same, right?
No.
Oh, okay.
It is the same.
Yes.
Okay.
So let's have a look into this one.
Create table names id integer primary key how to increment.
We've gotten table names and we've got fields and ID, which is counting up.
So maybe, maybe let's write this down.
We've got an ID, that's the first row.
Then we've got this name, which is the second row.
Okay, good name.
Dragging to the mouse is a little bit hard, but yeah, this is our table.
And the table is named names.
Okay.
This is our provider name.
Perfect.
And this is our.
This is our complete database.
All right.
We already have all this information listed over here in these few lines.
Now, let's see.
We've got matches.
We've got track users and track users within within kind of rack X.
So this should work for both.
We do not care about this one.
And then let's see, we've got delete get type insert on create query.
So these are now all the things we we have this content resolver which is asking to get access to this
one and these APIs will be returned back.
Here's our cursor query.
So this is our entry to this database entry.
So we can, we can do update, we can delete, we can do inserts and stuff like this.
So we have it seems like we're having full control of this one.
Yes.
Nice.
Then I would suggest.
Let's have a look.
What's thought inside there?
Let's see.
So, adb shell.
And then let's put this on the right and this on the left.
Okay, so we are having our content.
Yes.
Let's make this a little larger.
Sorry.
Smaller.
Okay.
And now we start with simply query to see if there are already data in there.
So let's see.
Here we have it.
Okay.
ADB shell.
That's not necessary right now.
But then content query.
Then we have to provide the URI and the URI is the URL we have seen over here.
So let's put this farther on the left.
That's the URL.
We want to fetch the information and track users.
Okay, then let's see what's next.
Okay.
And then we can define and projection and other things.
But if we are not providing anything, I mean, we we are just returning back the data which is being
stored inside there and that's good.
So we can close this one, put this on the left, and then let's see and we can see no results has been
found because we have not locked in into this application right now.
Okay.
So now is the point where we need some credentials and I have planned it in this way to show you that
it makes a huge difference if you test an application, if you and if you started from the beginning
or if you're testing an application which already has some context in case of our activities, maybe
you want to recap certain things.
If those features really does not work, maybe there hasn't been some context inside this application.
And this was the reason for for all these error messages, which means if we are having an custom application
which is running on real device and we have access to those activities content provider via our own
application, then maybe we could read out or we could perform certain transactions.
All right.
Okay.
So here we have learned the hard way that if you test something, do it without content, but also through
the exact same steps back again with some content.
All right.
The credentials for this application are shown here, and these can be used to log into this one right
now.
So therefore, let's do this.
Okay?
I mean, we are hackers, so therefore let's do it this way.
Input text then.
So it's not capital D, it's lowercase D.
And now input text.
That's the password.
Okay.
Let's hit login.
Invalid credentials.
Interesting.
So these are not the correct credentials.
Then let's do it with check.
Whoops.
Not here.
Input tax check.
And here we are having.
Check and 123..
All right, this works.
So not sure what's happening with these.
Maybe they need to be activated or things like this, but we have to use check.
Okay.
I will.
I will revert my animation and only print the correct ones.
So now we are locked in.
So let's see.
Transfer from account.
We simply hit get accounts.
Then we have the amount.
Let's say we want to transfer 100.
And let's see.
Transfer successful.
We have some some view.
I guess that's still the same interface.
Okay, then let's go back.
View statement.
Message success from to amount.
Here we can see the transaction transactions and change password maybe.
Let's also do it this one.
Oh, we have to we have to stay in the password policy.
So I'm using input text test at 1 to $3.
Yes.
Password successful and restart to perform this OC.
And we can also see updated password from two.
So we are receiving an SMS which contains our old password and also the new one, which sounds absolutely
ridiculous, right?
Yes.
But that's that's how it is right now.
So now let's click restart.
And we also have auto credentials.
And then we can now hit log in.
And invalid credentials because the that's interesting the out of it credentials it would be now pretty
interesting if they are the old or the new settings.
So let's see and test at I'm sorry then let's do it this way.
Look in.
Okay, so we can see the credentials has been changed, but it seems like that the credentials in these
shared preferences are only updated after we have successfully logged in.
So if we change the password, the autofill option doesn't work anymore because it contains the old
password in there.
Interesting design decision, but we are here for the content provider, so let's get back to them.
Let's see.
We simply hit the upper arrow key and now let's see if there's something inside here and then we go.
We can see Row zero is name check and row ID one.
Row 182 is also checked.
So this application locks every user that logs in to this app, which is amazing because we can fetch
this application, we can fetch these information from from our external application, and then we can
combine these to maybe change the password.
Do we still remember the change password activity?
Of course you do.
Now we've got the username and the attack vector would be the following.
Our malicious app in this one over here is using this content provider to retrieve the username out
of this application.
So now our app knows.
Okay, there is a username check inside here and now our application can launch the change password.
The strange password intend with this username to maybe change the password of this user without having
access to to the original user credentials.
Let's try this real quick.
I mean, it's now related more to the activities, but this is done pretty quickly.
Maybe we still have it here.
No.
So let's see.
Is it still open somewhere?
Hmm.
Okay.
Yeah, we still got it open.
So now we are not using admin, we are using check.
And to make this invalid attack, let's reset everything.
All right, so now let's open the change passport with the intent.
Check.
Okay.
And now let's see if you have changed your passport.
And then we are using add 1 to $3.
Change passport successful.
All right.
And here we get the SMS.
So now we know we can change the passport.
If we just know the username, this would be an absolutely ridiculous flow.
All right.
We got this information from our content provider over here.
So here we have simply read out those information.
Okay, so now let's try to hide our tracks.
So let's say we are locking in into this application.
Whoops, we need to restart it first.
So we are looking in at check.
Must be password hacked et oops.
At one, two or $3.
Okay.
Now we could make no transfer.
To account.
So we are clicking get accounts to get the account of check and we are not transferring it to this account.
Was there already a success message?
Yes.
Here we have it now.
Okay.
So we've got now two locks.
We've got the lock regarding to the user.
Log in and we've got this view statement.
So to be absolutely rock ninja, we have to manipulate both.
But now we will only focus on on this one right now because this is the interaction with the content
provider.
Okay.
So let's see, how can we how can we delete our tracks if we now read this once again?
We want to delete this part here.
And yeah, let's do this together right now.
So let's make this a bit larger and then content.
So the help over here is absolutely amazing.
So what we need is delete.
We want to use content delete.
Then we're providing our URI and then we have to use this bind with this binding.
And this is a little bit complex, but there's also an example underneath.
Yes.
We do not have to use the spine.
We could also simply use the square clause.
Okay, so we are simply using this part.
Let's copy this.
And now we are just inserting the correct values so we can make this a little bit larger.
Okay.
And once again, maybe let's fetch this information.
Okay.
So and now we want to delete from the track users.
We want to delete.
Where and now the ID.
Is equal.
Three.
I'm not sure if we have to provide this in one single quote in there, because that might be regarding
to strings.
But let's simply try this out.
Okay.
No error message.
Let's see if this row has now been deleted.
This.
This one over here.
Yes.
Perfect.
So this is how we could hide those those things regarding to this content provider so we can delete
entries, we can select, we can also insert entries.
So maybe yeah, maybe let's insert a new entry.
Let's say Dinesh was the user which, which last looked into this application and had made this transfer.
So let's see how this can be done.
Okay.
So content, where do we have insert?
Oh, he at the beginning.
So that's why I missed it.
You can navigate around with this one usage here.
You can see insert usage, update usage, the need usage query usage core.
Okay.
So let's take this insert part.
Let's see.
Okay.
We are taking this example and then once again, we are renaming it.
Yes, here we are having this, which is a little bit more complex regarding to those find things.
But we can make this.
Okay.
So this is our old track.
And now let's see, we want to use this content provider over here.
And now we have to use the spine.
And now we need to tell the women.
We need to tell what we need to add into this one.
So we want to add a new entry into this into this table over here.
And what we have to do is we have to insert a new row.
And this row, the parameter we want to insert has the name Dinesh.
The first parameter, it's an auto increment, which means it will be automatically being assigned to
ID three.
This means we only have to provide the name we want to insert into this table right now.
So this means we only need one bind.
So the second one from the example can be deleted.
Okay.
And now the structure is relatively easy.
First we've got the column name.
We can see the column name is name.
Okay, perfect.
Next we've got TSS, which is the type and means string.
And here we have now the string we want to insert.
In this case, it's simply just Dinesh.
All right?
And this is how we can add Dinesh into this one over here.
In case if you would have been multiple fields, then we would need to create multiple points over here.
All right, so let's see if this works.
No error.
That's good.
And now let's see.
Crack users.
Okay.
Interesting.
We can see the net is being inserted over here, but that's not that rock anymore because the NASH has
now the ID ID for and this is the reason because one, two and three cuts deleted and now we have been
assigned a value four.
So if you also want to be more rock, we have to update this entry, which is also, um, pretty good
exercise because then we have done everything.
Okay, so let's see content.
How can we update this one, insert update.
So that's, that's simple.
Yeah.
It's now the mixture of both of inserting and deleting.
All right, so let's take this example.
And this one over here.
And then we have we have recapped everything with our content providers.
So we've got content update URI and then we're taking this one.
Okay.
And now I clear the screen real quick.
That we have it nice and cleanly.
Okay.
So we've got content theory, then we've got our database, then we've got now our bind value, string,
new value.
And then we've got our statement.
Okay.
So this can be deleted.
And now let's fill into this one.
So our value by value string new value.
We want to update the name authority ID from type integer to three.
There.
The ID is equals four.
Let's see.
There's this one missing.
No arrows.
Let's see if this has worked out.
So let's query this once again.
Yes.
There's no little bit issue to the role, but we can see this entry has been updated.
So within the lock we've got now, ID one, two and three and this one over here, that's the Nash.
It's, it's the user who has last locked in into this one based on those IDs.
All right.
Okay, perfect.
So this is how we can how we can mess with this one around.
Okay.
So this is how we can delete entries, update entries, insert entries or query entries within an content
provider.
There aren't that many more options.
And I guess these are absolute sufficient enough to to do this.
Okay.
So that's all from the content provider part.
In the next video we will have look into broadcast receiver.
So how to abuse this one to yeah.
To perform some amazing stuff I will see you there.