Scribd
Upload
56 views3 pages

Drozer

Drozer is a security testing framework for Android applications that enables researchers to identify vulnerabilities and assess application security. It provides tools for application enumeration, component exploitation, and security misconfiguration checks, and includes installation instructions for both Windows and Android emulators. By utilizing Drozer, security testers can effectively analyze application security and uncover vulnerabilities.

Uploaded by

rilivypo
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
56 views3 pages

Drozer

Drozer is a security testing framework for Android applications that enables researchers to identify vulnerabilities and assess application security. It provides tools for application enumeration, component exploitation, and security misconfiguration checks, and includes installation instructions for both Windows and Android emulators. By utilizing Drozer, security testers can effectively analyze application security and uncover vulnerabilities.

Uploaded by

rilivypo
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 3

Drozer: AnDroiD Security ASSeSSment FrAmework

Introduction to Drozer

Drozer is a comprehensive security testing framework for Android applications. It allows


security researchers and penetration testers to identify vulnerabilities, exploit security flaws,
and assess application security. Developed by WithSecure (formerly MWR Labs), Drozer
provides powerful tools for interacting with Android devices and apps via the Android Debug
Bridge (ADB) or network connections.

Why Use Drozer?

Drozer helps in:

 Application Enumeration: Identifying installed apps and their permissions.


 Component Exploitation: Testing activities, services, broadcast receivers, and
content providers for vulnerabilities.
 Security Misconfigurations: Checking for insecure application settings.
 Exploit Development: Assisting in crafting and testing exploits for Android
applications.

Drozer Installation Guide

1. Installing Drozer on Windows

1. Download Drozer from the official GitHub releases page:

https://github.com/WithSecureLabs/drozer/releases

2. Install Drozer using the following command:

pip install drozer-3.1.0-py3-none-any.whl

3. Verify the installation:

drozer --version

2. Installing Drozer Agent on an Android Emulator (Genymotion)

1. Download the Drozer Agent APK from GitHub.

https://github.com/WithSecureLabs/drozer-agent/releases

2. Install the agent using ADB:

adb install drozer-agent-3.1.0.apk

3. Open the Drozer Agent app inside Genymotion and Press to Launch.
3. Connecting Drozer to the Android Device

1. Set up port forwarding:

adb forward tcp:31415 tcp:31415

2. Start Drozer Console:

drozer console connect

Drozer Commands for Android Security Testing

1. Information Gathering

 List installed packages:


 run app.package.list
 Get package information:
 run app.package.info -a com.example.app
 List exported components:
 run app.package.attacksurface com.example.app

2. Activity and Service Testing

 Enumerate exported activities:


 run app.activity.info -a com.example.app
 Start an exported activity:
 run app.activity.start --component com.example.app
com.example.app.MainActivity
 List exported services:
 run app.service.info -a com.example.app

3. Content Provider Exploitation

 List accessible content providers:


 run app.provider.finduri com.example.app
 Query a content provider:
 run app.provider.query content://com.example.app.provider/data

4. Broadcast Receiver Testing

 List exported broadcast receivers:


 run app.broadcast.info -a com.example.app
 Send a broadcast to a receiver:
 run app.broadcast.send --action com.example.app.CUSTOM_INTENT

5. Checking for Debuggable Applications

 Find apps running in debug mode:


 run scanner.misc.debuggable

Conclusion
Drozer is a powerful tool for Android penetration testing and vulnerability assessment. By
following the installation steps and executing the provided commands, security testers can
efficiently analyze application security and uncover potential vulnerabilities.

You might also like