- Hello all and welcome to the new video of Android Security and Exploitation by
Pentester Academy. My name is Aditya and I'm your course instructor for this entire
training series. So, this training is available at PentesterAcademy.com and you
can also check out the certifications at securitytube-training.com. In this video,
we are going to have a look at the Client Side Injection which is another
vulnerability. Basically something common which you see in web applications as well.
Basically, Client Side Injection means is, let's say if an application is taking
input from the user and it's parsing in, parsing it to may be some SQLite queries
and it's not validating what kind of input the user has given. So that is where
injection attacks can take place. Now it could be in the case of SQLite, it could
be in the case of some other component, but this is the whole underlying concept.
So in terms of SQLite injection as you know that Android applications store the
database as SQLite. One of the use cases of SQLite injection will be if an
application is doing some kind of local validation or storing something in the
local database and is taking input from the user and not verifying it or not
sanitizing it before passing it to the SQLite queries then that application might
be vulnerable to SQLite injection. Let's take an example, we have an application
called sqliteapp.apk in the Client Side Injection folder and let's first of all
connect to a VM, Genymotion VM, 192.168.57.102. 192.168.57.102. We have
the device listed over here. Let's go ahead and install the sqliteapp.apk. This
is how the application looks like and let's first go ahead and register
ourselves. Maybe I'll just give Aditya password, register and enter some of my
personal details over here. So, Gupta, adi@attify.com, phone number and just
submit. Now if I have to log in, I need to know my password in order to fetch the
details. So, once I enter the correct password, then I can click on login and
and it will fetch up my details. What our goal is over here is we have to somehow
bypass this particular validation. So the first thing we'll do is, we'll simply
reverse the application using dex2jar. So dex2jar sqliteapp.apk. Now dex2jar has
successfully reversed the application and we can basically use jd-gui to open the
jar file which was created. And here if you look inside of the database connector
class, we'll basically see the addRecord and the getRecord methods. The addRecord
method simply enters the user values into a database called vulnerable-db and
getRecord selects the data from the vulnerable-db and shows it to the user.
Now we can confirm it by simply doing an adb shell and going inside
data/data/com.attify.sqliteapp. If you look inside the databases, you'll have a
vulnerable-db over here and if you open it up with sqlite3, .tables then select *
from USER RECORDS. So we'll basically see the entry over here inside the table
called USER RECORDS, inside the database called vulnerable-db which is exactly what
we saw inside the jd-gui. Now since we know how it is basically...let's open
jd-gui sqliteapp. Now since we know that how it is parsing the user input values
into the SQLite query, we can try to find a bypass for this. So if you look over
here, this is the select * from USER RECORDS where username equals to the user
input and password equals to the user input. So if we open leafpad... If you
look over here, this is the username and this is the password. So what we can do is
we can try to make the application believe that the user exists and the validation is
correct by adding or by putting something like 1'or'1=1 inside the paramString. Now
1'or'1=1 is a one of the like most popular strings in SQLite injection or SQL
injection where you can simply make the SQL query believe that this particular
statement is true. If you look over here this statement now becomes SELECT*FROM
USER_RECORDS WHERE USERNAME=1 or basically adding a condition and saying or 1=1. Now
since 1=1 is always true, the application thinks that this particular statement is
returning true and thus the validation is accepted. So let's try to perform the same
thing over here and maybe enter some incorrect password and simply add, let's
say 1'or'1=1. Basically clicking on login. Now we are able to see the user records.
So this is what happens in the SQLite or Client Side Injection and one of the ways
to bypass or actually I mean protect it is by sanitizing the user input before
applying the SQL queries. So this is how the sample code look like which was there
in the application and that's one of the most common mistakes made by the
developers of not validating the user inputs. So that's all for this video. I
hope you like the video and if you have any feedback or queries, feel free to drop
me a mail at adi@attify.com. Also you can tweet to me @adi1391.