So the next time a vulnerability that grocer is really good at being able to detect our content provider
based vulnerabilities.
Content providers are essentially a way of being able to access data from an application from somewhere
external to that application.
So if like app no one wants to access data from app number two it would typically use a content provider
to be able to access that data.
Now some content providers are hidden behind permissions.
Some of them are not hidden behind permissions.
If they're not hidden by permissions they're accessible from anywhere which means that we could potentially
do something with it to expose data.
Now with that in mind we have to consider some of the some of the some of the information here regarding
the content providers.
In general being able to query a content provider isn't necessarily an issue.
However if you're able to do a sequel injection to a content provider that can be a big issue.
So we'll take a look at what that can typically look like inside of here.
So if you want to expose content providers that exist on an application we can get through Roser and
we can do that through the following comments here.
So if I run Skinner provider done find your eyes like a hyphen and I give it the name of the application.
What this will do is it will expose to me all of the user eyes that exist.
You are either the content providers that we may be able to query so you can see that there's two of
them here that we're actually able to query and I just want to give you a bit of an idea about what
this looks like from sort of like a typical legitimate perspective.
So if I create a shell into my device here I can do something like this.
I could see content query.
I think you do.
Hi it you or I.
And then you put it in like that that you are that you want to query.
And what happens is this will essentially run through a specific type of query and you can typically
provide them with with some arguments and those arguments can be interpreted and potentially exploited.
So I think I might have to put two hyphens into it.
You have to put two hyphens into the right.
So there should be two hyphens here.
So this is what the actual command would look like.
So you see what I run this.
It actually gives me data that it's inside of the database.
And what I can do with this is I can provide a specific projection right a projection is the fields
that I actually want to see.
So for instance if I want to see just the title I could see a projection and title which will show me
just the title.
So if you take a look at the actual code here it can help you understand a little bit more when we use
the query portion what it will do is it will utilize this query function inside of the provider and
all content provider is going to look very similar.
So what you'll see here is that when it actually runs the query it runs it through a query built there
and it provides it with a projection.
Now a query builder is generally relatively secure.
However projections have to be set in a very specific way.
What we should be doing with a projection is telling the query builder what columns are actually valid
to be able to be input it if we don't do this then you can input theoretically anything into that projection.
And it will actually get executed a sequel code.
So to demonstrate this sort of idea let me show you what this looks like from like from my ADP show.
So I have the projection for title instead I could replace this with something different.
I could do something like Star from sequel light underscore master and then I can put like the comment
to come up the rest of it.
What this does is.
So when we do the projection it injects the data between select and from.
So what I'm doing is I select is already there.
So then I just put Star from sequel light master and then I comment on the rest.
So that just started with the query to select everything from the master table the master table holds
all of the information about what exists inside of this database.
So what you can see here is you can see all of the table information.
This tells me a sequel injection is possible.
So this allows me to be able to see that sort of information.
Now of course we don't always want to be doing this manually because it takes a lot of time to test
a lot of content providers.
So luckily drones are actually has some built in ability to be able to do that.
So the way that you can test this is you can do something like this.
You can say I'm run scanner providers that are but think it's your stock provider injection and then
hyphen a.
And then we put in the name of the application again.
And what this will do is it will attempt injections on each of the providers and it will tell you if
you can inject the projection or if you can inject through the selection which you can't do in both
of these cases.
So when we talk about the selection the selection is actually the where clause so we can give it a where
clause we can give it a projection as well and both of those seem to have injection enabled on them.
So in general once we have this information we're able to run a query like I just did here to get all
the information from sequel master and then utilizing that we can get other pieces of information if
there's more data inside of this database that we shouldn't have access to we'll be able to get to that
utilizing this.
So that's sort of the general idea in gist of what we're going to be doing with this.
And just to show like you can get the same sort of information inside of Groser and you can get that
through running on scanner provider sequel tables.
And what this will do is it will essentially just give you all of the tables that exist.
If a if a content provider is vulnerable.
So as you can see it tells me that these are the tables that are accessible through this sum through
this injection.
Right.
So when I'm doing this like for instance if you want to see what an injection could look like I could
replace this with star from.
Like for instance Android metadata that could expose the data to us.
I could do this from from notes which is the other table that exists and that's sort of stuff that we
got from the content providers.
That's not overly interesting but I mean you can get a lot of other things such as like this equal light
version.
I think you could do that just generally through something like
this for instance.
And that would be a good example of the sort of things that you could do with this sort of vulnerability.
So this gives you a good idea of how um how content providers can be exploited and how to find those
vulnerabilities through drugs or.