- Hello, and welcome to the new video of Android Security and Exploitation by
Pentester Academy. My name is Aditya and I'm your course instructor for this entire
training series. So this course is being run on PentesterAcademy.com and you can
also check out the certifications at securitytube-training.com. So this
particular video is about the Damn Insecure and Vulnerable Application, also
known as DIVA. And in this particular video, we'll have a look at one of the
input validation issues. Now an input validation can happen in multiple ways and
one of the ways is if the application takes the user input and parses it inside
a SQL query and executes the SQL query as it is leading to flaws such as
SQL injection. Now this is a classical example of authentication bypass using
SQL injection. So let's have a look at the exercise which is input validation
part one. So in this exercise, the objective is to try to access all the user
data without going any username. It says that there are three different users by
default, and the task is to output data of all the three different users. Now if I
don't know what the username is, I can try something as test where it says "user test
not found." So in order to look more deeper inside this vulnerability, let's
have a look at the source code. So this is the input validation one which is
somewhere over here or the SQLInjectionActivity.java. So let's open
it up, and if you look here, it takes the search text which is the text that you
enter over here, puts it inside a variable called srchtxt, and parses it inside a SQL
query as SELECT * FROM sqliuser where username equals to whatever you have
entered. Now in these kind of cases what we can do is parse in a malicious
string such as "1' or '1' = '1'" making sure that this particular string in
SQL will always be true, and this is because we're using a conditional or
greater or over here. So let's say the SQL query is this one, SELECT * FROM
sqliuser where user equals to this particular value. Let's also copy the
closing tags which is this one. And this is what the application is essentially
doing. And it places the user text whatever we have entered. Now, if we
enter something like an admin, it tries to select the user admin from the table. And
if the argument does not exist, it simply returns a false. But if we try something
like this, our string "1' or '1' = '1'" in place of the user, the string
becomes SELECT * FROM sqliuser, where user equals either one or the other condition
is if one equals to one. And since one equals to one is always going to be true,
this entire statement is going to run true and all the user's information will
be dumped. So let's try this over here. "1' or '1' = '1'", and we add
everything after this as a comment, so the two hyphens, and we click on search, and
we see the entire information of all the users. And this is how a SQL injection
in an Android application takes place. Now also another thing to note is this
particular vulnerability will be mostly applicable in applications which are doing
something locally, because it's taking the user input and passing it inside the local
SQLite query and executing it. So that's all for this short video. I hope you like
the video and if you have any feedback or queries feel free to reach out to me
@adi1391 on Twitter, or you can send out email to me at
adi@attify.com. Check out the certifications at
securitytube-training.com. That's all. Thank you.