Inserting data into content providers

Like any database-orientated application, content providers may also facilitate the ability to insert data into their SQLite databases or file stores; should any content provider not restrict this functionality using the appropriate write permissions, an attacker may be able to insert data into the SQLite database maliciously. This tutorial discusses how you can perform this kind of attack; in the next chapter, we will look at the actual code that causes these vulnerabilities and discuss some remedies.

How to do it...

Before we go inserting data into the content providers, we need to know what the schema or column set up for the database looks like; you can enumerate this information using the following command from your drozer console:

dz> run app.provider.columns [URI]

In the preceding command [URI] is the URI you wish to find out about. For instance, if you want to run it against Sieve, you would execute the following command:

dz> run app.provider...