The next time I found her ability that Cruiser is really good
at being able to detect. Our content provider based
upon her abilities of being
able to access data from an application from somewhere
external to that application. So, if like top
number one wants to access data from App number to it
was typically as a content provider to be able to access that
data. Now, I'm content providers are hidden behind permissions.
Some of them are not hidden behind permission. If
they're not here by in permissions, they're accessible from
anywhere, which means that we could potentially do something with
that to expose data. No, we thought in
mind, we have to consider some of the, some of the, some of
the information here, regarding the content providers up in
general, being able to create content provider isn't necessarily an
issue. However, if you're able to do SQL injection to
a content provider, that can be a big issue. So we'll
take a look at what that can typically look like inside of here. So,
if you want to expose content providers, that
exist.
On an application, we can get through troesser and
we can do that through the following commands here.
So if I run a scanner. Provider.
Find, uri's Lego
- A and I give it the name of the application.
What this will do as it was supposed to me. All of
the URI, is that exist? You are Riser. That content providers
that we may be able to query. So you can
see that there's two of them here that were actually able to query. I
just want to I want to give you a bit of an idea about
what this looks like from Sir Vega typical legitimate
perspective. So if I treat a shell into
my device here, I can do something like this query. I
think you do. I spend at URI and
then you put in like the URI that you want a
query.
And what happens is this will simply run through
a specific type of a query and you
can typically provide them with with so arguments.
And those arguments can be interpreted in potentially
exploited. So I think I
might have to put two hyphens into it. Yeah, I have to
put two hyphens to Bri to high
fence here. So this what the actual command would look like.
CC my run. This, it actually gives me data that
it's inside of the database. If I can do with this, as
I can like provided specific projection. Write a
projection, is the fields that I actually want to see so friend. If
I wanted to just the title, I can say projection title, which
will show me, just the title. So, if
you take a look at the actual code here, I can help
you understand a little bit more. When we use the query Porsche.
What it will do is it will utilize this query function
inside of the provider and all content providers going
to look very similar. So we'll see here is
that when it actually runs the query, it rented to a
query Builder and it provides it with a production. Now, he's
generally relatively secure.
However, projections have
to be set in a very specific way. We should be done with the
projection is telling a query Builder, what columns are
actually felt like to be able to be inputted. If we
don't do this, then you can input theoretically anything into
that projection. It'll actually get executed a seat.
So did demonstrate this sort of idea. Let me
show you what this looks like from like, from my ADB shell.
So if the projection for title instead, I could replace
this with something different, I could do something like to starve from
SQL, light underscore master and
then I can put like the comment to coming up. The
rest of it with this does is. So when you
do the projection, it injects the data between select and
from that. What I'm doing is that this life
is already there. So they just put star from SQL, light
master and then I come it's at the rest. So that just showed
him the pic for you to select everything. From the master table. The master
table holds all of the information about
what exists inside of this database. So what you can see here, you
can see all the table information. That tells me the
SQL injection is possible. So this allows
me to be able to see that sort of information.
No course, we don't always want to be doing this manually
because it takes a lot of time to test a lot of content providers to
Laclede. Rose are actually has some built-in ability to
be able to do that. So the way that you can test this, if you
can do something like this, you can say run.
A scanner. Providers.
Viator. Injection.
And then - A and then we put in the name of the application again.
I want this with you, is it will attempt injection donnisha
providers? It'll tell you, if you can inject to the projection
or if you can inject you the selection, would you
can do in both of these cases? So when we
talked about this selection, the selection is actually the where Clause so we
can give it a where Clause we can give it a projection as
well and both of those scenes have injection enabled
on them.
So now in general, once we have this
information, were able to run a crew like I just
did here to get all the information for sequel master. And
then you do, I think that we can get other pieces of information. If there's
more date, instead of the state of peace that we shouldn't have access to will be
able to get to that utilizing this. So, that's sort of
the general idea. And just if what we're going to be doing with this and
just a show, like, you can
get the sensitive information inside of drozer, and
you can get that through running gum. Scanner. Provider.
It sucks, equal tables.
And with this will do is it will essentially just
give you all of the tables that exists if
a if a content provider is vulnerable. So you
can see it tells me that these are the tables that are accessible
through it. Some through this injection, right?
So what I'm doing this, like for instance,
if you want to see what an injection could look like, I could replace
this with star from like for instance, Android metadata.
I can expose the metadata to us. I could
do this from from notes, which
is the other table that exists and that's serious out that we
got from the content providers. That's not overly interesting, but
I mean, you can get a lot of other things such as, like, the sea polite
version. I think you could do that, just generally through
something like, that.
this, for instance,
And I'll take an example of the three things that you could do with this sort of vulnerability. So
just give you a good idea of how long how content
providers can be exploited and how to find those vulnerabilities Street
Roeser.