‫Instructor: Hi.
‫Within this lecture we are going to see how we can hack
‫into content providers of this application.
‫And in order to do that, we are going
‫to have to discuss what is a content provider
‫and what does it do in Android development.
‫But let me just open this under Android manifest XML
‫so that you can see what I'm talking about.
‫So over here in the manifest folder,
‫we have seen that we can actually see
‫all the activities before, right?
‫So that we can gather information about the activities
‫and we can actually do a manual intent to go to
‫those activities using the ADB shell, right?
‫However, other than the activities,
‫we can see the other compliments of the Android development
‫like this content provider over here.
‫Like, we have a track user content provider.
‫So what is it and what does it do?
‫And actually why is it in the Android manifest?
‫So we have all the basic components in the Android manifest.
‫We had to have them, otherwise it won't work.
‫So what do I mean by basic components?
‫So I'm gonna go over to developer.android.com
‫and you don't have to do that, by the way.
‫I'm just doing it for the educational purposes.
‫So I'm gonna go over to the guides or reference over here
‫so that I can read about the underwritten platform itself.
‫So let me go to guides.
‫Yeah, this is what I'm looking for.
‫So if you go over here to application fundamentals,
‫we can see the application components.
‫So there are basically four things that make
‫up an Android application, which is activities, services,
‫broadcast receivers, and content providers.
‫So maybe you don't know all of the things.
‫We have actually seen the activities, right?
‫But we haven't seen services.
‫So what is a service?
‫Service lets you run things in background
‫like downloading data from the internet.
‫User doesn't see it happening, but it happens
‫in the background.
‫In broadcast receivers, you use broadcast receivers
‫to transfer information between applications
‫or inside of the applications as well.
‫For example, if you want to share a data
‫with another application, you can use a broadcast receiver.
‫And in the content providers, you provide a content.
‫You actually try to get data from some source
‫like getting the contact information
‫from the phone book itself.
‫So you can write your own content providers
‫and we generally use them with databases.
‫So as we have seen, a content provider in our application
‫we can try to find it in JDXD compilation like this, okay?
‫And we can try to analyze it.
‫So over here, if we can come to this
‫content provider Java file,
‫we can see all this data.
‫So even though we can see everything in clear over here,
‫there is a way to see these URLs like in encryption cases
‫like ProGuard cases as well.
‫For example, if we have this URL, which is what we need
‫in order to analyze this content provider,
‫which is a content:// package name
‫and the content provider itself
‫and then the track user's description.
‫So this is a URL actually.
‫It leads us to somewhere where we can gather data
‫and we can try to query data
‫from this content provider using ADB shell.
‫So in this case, it will most probably return us
‫the user information
‫but it can store some data that developers
‫don't want you to see so it would be a good practice
‫to gather information
‫from this content provider in a real life example.
‫Okay.
‫So I'm gonna copy this.
‫And even if it's encrypted with ProGuard, it's a URL.
‫It's a string.
‫We can still see this in smaller files or in any other files
‫like maybe in values and in strings that examine our stuff.
‫Okay.
‫So make sure you find this content provider
‫and copy the URI.
‫Okay.
‫And then what we are gonna do
‫we're gonna open the ADB shell as usual.
‫So I'm gonna come over here and start the ADB.
‫And in order to do that, of course, I'm going to
‫exit out of this one and start a new one.
‫Okay.
‫Because it might lose the connection.
‫So here you go.
‫Here is our shell.
‫So remember we have executed the AM comment before
‫in order to fire up an intent.
‫So rather than AM we are going to use
‫content query this time.
‫So we use query keyword
‫in order to retrieve data from some database.
‫And in this case, we are using this in order
‫to retrieve data from this content provider.
‫It starts somewhere inside of our application
‫inside of our data folders.
‫And in order to test this,
‫we are going to paste the URI that we have copied before.
‫And here you go.
‫Now, make sure you include this URI parameter over here
‫like that, and then paste the thing that you have copied.
‫So this is the comment
‫that you should run content query dash dash URI
‫and the URI of the content provider.
‫So once I hit enter, I can see the content.
‫Like raw is zero, ID is one and name is the dash.
‫So it didn't give me much, but if it stored something else,
‫I would have gotten it anyway, right?
‫So let me just try this with another user.
‫So remember we had two users, so I'm going to restart this
‫and rather than Denise, I'm going to sign in with Jack.
‫Okay.
‫And I believe the password was the same thing
‫Jack@123$.
‫And I'm gonna log in with this.
‫Okay.
‫And here you go.
‫Now I'm logged in.
‫So the username is correct.
‫I'm gonna come over here
‫and run the same thing one more time
‫and here you go.
‫Now, I got the other user here as well.
‫And, again, this is not very much,
‫but in real life you can get much more valuable information
‫from a content provider.
‫So I hope you enjoyed the CTF section.
‫So try to find the other vulnerabilities
‫and other exploits by yourself if you have time
‫because we have learned a lot during this course.
‫So you may try to find vulnerabilities
‫by just looking at the code.
‫You can try to understand what codes do what
‫and try to find your way into hacking this application
‫by yourself in your spare time.
‫And it will be a very good practice for you.
‫And if you find any other good CTF challenge online,
‫please feel free to share it with me
‫so that we can maybe add it to the course later on.
‫And we're going to stop here.
‫And within the next section,
‫we're going to see how network attacks
‫and network attacks work in the mobile devices as well.