Connect to take a look at issues that are related to input
validation. So when we ever get
like input from a user, we should be validating that
in put, in whatever way that we can. So we should be
like a sanitizing, make sure that they don't even put anything that's vulnerable
or that could potentially lead
to an exploit essentially. So there are
a few different types of input validation and ruse
that can occur inside of Android app. So we're going
to take a look at a few common ones right now. So for the
first set of input, validations they have to
do with database validation. So when were
you putting things into this? We can see that. For instance if I put in user
here and press search will see user not found.
You can see lab coat back whatever R-value
that's it. Put it is and it
will tell us that it's not found or it will Echo back
the details of the user. Presumably, if we had put one that
is found.
We're looking for the code that's related to this. We can go to SQL injection
activity. And this will show us exactly what's going
on.
So as you can see here, it's doing the rock. We're against
the database. And this is the query that's actually happening.
And you can actually see that when it encounters an
exception. It's going to actually show the exception in the
word luck. This means that if we go into our log
cat, which I've got open sharing Android Studio when
I M put in something invalid, so,
for instance, some a very good example of this
for testing purposes would be like a single quote. A single chord
is a piece of SQL, syntax visitor. Like code. It
should cause an error and see when I searched this. We've got
this error here that says unrecognized token. It tells
us that were interpreting that token as
code rather than interpreting it as an input. So, this
means immediately to me that this is vulnerable to SQL injection.
So let's take a look at how we can craft SQL
injection with this. We have access to the query. Hear
it again. This isn't an uncommon thing. If we can be compiled the
code, we can gain access to the queries. And as you can see, or
input is going in right here.
So come to the right in the middle here, right in between two single
quotes. With that tells me is that if I can end
the single quote and then input something that's always true. And
then maybe put a comment at the end that will
allow me to execute where user equals blank or say,
1 equals 1, which is always true, which will
return to me the whole database back. So let's
take a look at exactly what that looks like. If I put the closing quote
here. This will cool with the users in it. And
then we'll say it or or 1
equals one. And then
we can put a comment to the two dashes at the end of the comment or
1 equals one is something that's always true and
the closing single quote would close off this starting quote
here. So be user equals blank or 1 equals one.
And only comments that this and briefs you
are the send a single quote, here is an interpreted as
code, and it doing this, it will give us a valid
query. And not valid query is going to
return to us all of the content inside of a
database.
When I click search hear it exposes the whole
database credentials, right? You can
see that this is an example of being able to leak information
from a database using an invalid input. So
she contractions are very common type of input
validation error, that happens in a lot of different instances.
So this would be one example, and
this is one thing that you're always able to start past and I
always, will you get the errors actually printing in the log? It's
actually quite rare that someone would give you that. However, again,
if you just sort of like search for rock, query or query
in general, you should be able to find instances with
this sort of thing happens.
This is what type of input validation. That's relatively common. I'm
going to show you another type of input validation that is
rather interesting in a little bit different. So
we just want to hear you see that we can type in the URL to
show up. If I put in like to Google.
Ca for instance, our price
of you, you see it brings up the web page for Google.
So this is just like a simple web browser. And
if we going to the code, if it we can get a bit of a better idea of what's actually
happening. So you see here, you have the input validation scheme.
You see that it just has a load URL. No, on
the surface. This probably looks quite innocent because
load URL would imply to us that were just loading, any
sort of get a webpage. You were out. However, it be
interesting point here is that in Android files. As
you are always. Well, you can actually access files
on the system using the URL path of them.
So for instance, you can do something like this.
You could save file, you go colon and then you put three backslashes
and then you put it in the deposit of
files will save data data. For instance,
some I'm going to pick a file that I know exist.
This isn't part of the deal falls through looking at
we were taking a look at some and Secure Storage and
we know that there's one here called.
Car. Seem. Diva underscore
preferences. Eczema.
You can see our just put in the whole path of the of the
file itself.
And dumb.
At the other, some instances where this Alchemy crush on
you, it's not overly common, but it
could be from some other testing that I was doing
a related to this out for input validation. But let's
try this Diva references. XML.
You see, when I click on view,
hear it actually displays the file below here.
So have you remember, this is the file that we are created in
the end of the improper storage. So this
shows us how we can actually access that storage without
necessarily even having root permission. If we happened to
notice path, which they wouldn't be unreasonable for us to
know it. If we have it read a device, we can find it through easily or we
can find it to the code. We can actually access it.
If there's ever like a browser that happens to take in these file. So
this is a
very critical vulnerability to the laws for information leaks
and we can get to really any sort of file on the system utilizing
this and we might even be able to access this from other
applications.
House, like a provider that allows us to launch this activity may
be, right. So this is a very common and
critical vulnerability. So this is another type
of input validation that you can look out for something is parsley with
peach. Utilizing this whole on this load
URL. It's very possible that we'll
be able to load internal URLs which
are actually cost to file.
This is another type of common input, validation not again.
So we have databases and behavioral loading is
there type of input validation is a little bit
different and the way that it essentially works is by calling
external libraries.
So we'll see here is this uses the DJ and
I Funk. Function, but
class rather and you see that it uses them, a
very specific Pisa initiate, launch sequence. So
it was interesting about this is that if we
go to this son to this input validation 3,
More able to use real to put in some input that attempted to
get it to watch and you'll see a gives us access denied in
these cases, what were actually able
to do it. This is since it's loading a shirt object wiper it
mean. If it's probably written in C or C, + + C +
C + + a relatively Infamous for a buffer overflows
and you can put something we to dig into this input. We
may be able to get it to overflow. So for instance,
if I just type in like a whole bunch of ace and I
push the red button, you'll see the application crashes in
an application crushes like that. It tells
us that they could potentially be a problem and
it might be related to a buffer overflow if you
want to get a bit more detail. We can actually go back into the log logs
and I'm assuming it's probably going to give us some
information inside of here when we try to crash this. So let's
try this again.
Yeah, you'll see there. We got the whole like sort
of dumped.
This right here is what we would call a
stock Trace essentially. So you
can see it gives us a lot of information here at
the main things that you want to get here, is that you see the parts of
the stock that would actually accessed. So we can see, they were actually overflowing
the stock here and you can see that it's giving us
some errors related to that. Now, what happens
here is if we can actually specially crafted or
we may be able to get the device to
execute code which may be able to get
us access to on execute code under the permission of
the application itself. In this would be an extremely
critical vulnerability. This is like a CVS 10.0 but
even just getting DM, the stack Overflow to
happen, create a very critical vulnerability as well. So
often times like with jabu, he's
not coming to see a stock overflow. But if you're using C, C
plus plus libraries or language, is similar to that where you have to
do memory management. This is definitely something that's in the possibilities. So
if you're able to find something like this, if an extremely
Durability. And again, the things that you want to look
out for for this is any sort of class that is loading a
shared object. So, this is DJ. And I class, we
talked about this earlier in the series, but
you see that has exploded library, right Library,
you might be
loading, ISO files, which are typically C C plus plus.
Now one other thing that I will note about this
is that we Red Wing Ranch strings against this Library. What
are the strings that came up with strcpy their
string? Copy screen? Copy is one
of those. See functions is Infamous for buffer overflows if
things are allocated properly. So those are the sort
of instances where we can actually you do. I stream to
see what kind of functions might be getting called that reveals to
a scene of the function of getting called witches, strcpy our strength,
be right. So we can see that when that
is used. It seems like it's causing the buffer overflow.
So it seems like that, string, copy is, what's causing that sort of
problem to actually get remote. Code, execution is,
Barely more complex. Top make it won't be one that
will talk about in this, but I wanted to demonstrate how you might be able
to identify those that are problems in an Android application, to be
able to report them cuz he can even just finding a buffer overflow.
Like that is a critical vulnerability. So it
gives you an idea of a few different types of input validation.
So that might commonly be found in Android application. So
many of the issues in general are very critical because
they mostly allow you to access things. You shouldn't be able to or
potentially do remote code execution. So they're all
very critical vulnerabilities and old ones that you should be
able to relatively easily find if they do exist in
an application. So just give you certain some of the fundamentals to
be able to locate those