Drozer指北

安装

Linux

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
┌──(g0at㉿kali)-[~/Desktop]
└─$ wget https://github.com/FSecureLABS/drozer/releases/download/2.4.4/drozer-2.4.4-py2-none-any.whl
      
      
┌──(g0at㉿kali)-[~/Desktop]
└─$ sudo apt-get #assume-yes install python-pip                         
    
    
┌──(g0at㉿kali)-[~/Desktop]
└─$ pip2 install wheel
DEPRECATION: Python 2.7 reached the end of its life on January 1st, 2020. Please upgrade your Python as Python 2.7 is no longer maintained. pip 21.0 will drop support for Python 2.7 in January 2021. More details about Python 2 support in pip can be found at https://pip.pypa.io/en/latest/development/release-process/#python-2-support pip 21.0 will remove support for this functionality.
Defaulting to user installation because normal site-packages is not writeable
Requirement already satisfied: wheel in /usr/local/lib/python2.7/dist-packages (0.37.1)
                                                                                                                                                                                                                   
┌──(g0at㉿kali)-[~/Desktop]
└─$ pip2 install pyyaml
DEPRECATION: Python 2.7 reached the end of its life on January 1st, 2020. Please upgrade your Python as Python 2.7 is no longer maintained. pip 21.0 will drop support for Python 2.7 in January 2021. More details about Python 2 support in pip can be found at https://pip.pypa.io/en/latest/development/release-process/#python-2-support pip 21.0 will remove support for this functionality.                                    
Defaulting to user installation because normal site-packages is not writeable
Collecting pyyaml
  Downloading PyYAML-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl (574 kB)
     |████████████████████████████████| 574 kB 436 kB/s 
Installing collected packages: pyyaml
Successfully installed pyyaml-5.4.1
                                                                                                                                                                                                                   
┌──(g0at㉿kali)-[~/Desktop]
└─$ pip2 install pyhamcrest
DEPRECATION: Python 2.7 reached the end of its life on January 1st, 2020. Please upgrade your Python as Python 2.7 is no longer maintained. pip 21.0 will drop support for Python 2.7 in January 2021. More details about Python 2 support in pip can be found at https://pip.pypa.io/en/latest/development/release-process/#python-2-support pip 21.0 will remove support for this functionality.                                    
Defaulting to user installation because normal site-packages is not writeable
Collecting pyhamcrest
  Downloading PyHamcrest-1.10.1.tar.gz (43 kB)
     |████████████████████████████████| 43 kB 252 kB/s 
Collecting six
  Downloading six-1.16.0-py2.py3-none-any.whl (11 kB)
Building wheels for collected packages: pyhamcrest
  Building wheel for pyhamcrest (setup.py) ... done
  Created wheel for pyhamcrest: filename=PyHamcrest-1.10.1-py2-none-any.whl size=48898 sha256=7d5493ff342fd5ea5ec10a6d8713f7519bfcf4cc98d1b101cb75039f15e76e43
  Stored in directory: /home/g0at/.cache/pip/wheels/f5/8c/e2/f0cea19d340270166bbfd4a2e9d8b8c132e26ef7e1376a0890
Successfully built pyhamcrest
Installing collected packages: six, pyhamcrest
Successfully installed pyhamcrest-1.10.1 six-1.16.0
                                                                                                                                                                                                                   
┌──(g0at㉿kali)-[~/Desktop]
└─$ pip2 install protobuf
DEPRECATION: Python 2.7 reached the end of its life on January 1st, 2020. Please upgrade your Python as Python 2.7 is no longer maintained. pip 21.0 will drop support for Python 2.7 in January 2021. More details about Python 2 support in pip can be found at https://pip.pypa.io/en/latest/development/release-process/#python-2-support pip 21.0 will remove support for this functionality.                                    
Defaulting to user installation because normal site-packages is not writeable
Collecting protobuf
  Downloading protobuf-3.17.3-cp27-cp27mu-manylinux_2_5_x86_64.manylinux1_x86_64.whl (1.0 MB)
     |████████████████████████████████| 1.0 MB 349 kB/s 
Requirement already satisfied: six>=1.9 in /home/g0at/.local/lib/python2.7/site-packages (from protobuf) (1.16.0)
Installing collected packages: protobuf
Successfully installed protobuf-3.17.3
                                                                                                                                                                                                                   
┌──(g0at㉿kali)-[~/Desktop]
└─$ pip2 install pyopenssl
DEPRECATION: Python 2.7 reached the end of its life on January 1st, 2020. Please upgrade your Python as Python 2.7 is no longer maintained. pip 21.0 will drop support for Python 2.7 in January 2021. More details about Python 2 support in pip can be found at https://pip.pypa.io/en/latest/development/release-process/#python-2-support pip 21.0 will remove support for this functionality.                                    
Defaulting to user installation because normal site-packages is not writeable
Collecting pyopenssl
  Downloading pyOpenSSL-21.0.0-py2.py3-none-any.whl (55 kB)
     |████████████████████████████████| 55 kB 304 kB/s 
Collecting cryptography>=3.3
  Downloading cryptography-3.3.2-cp27-cp27mu-manylinux2010_x86_64.whl (2.6 MB)
     |████████████████████████████████| 2.6 MB 686 kB/s 
Requirement already satisfied: six>=1.5.2 in /home/g0at/.local/lib/python2.7/site-packages (from pyopenssl) (1.16.0)
Collecting cffi>=1.12
  Downloading cffi-1.15.1-cp27-cp27mu-manylinux1_x86_64.whl (390 kB)
     |████████████████████████████████| 390 kB 4.8 MB/s 
Collecting enum34; python_version < "3"
  Downloading enum34-1.1.10-py2-none-any.whl (11 kB)
Collecting ipaddress; python_version < "3"
  Downloading ipaddress-1.0.23-py2.py3-none-any.whl (18 kB)
Collecting pycparser
  Downloading pycparser-2.21-py2.py3-none-any.whl (118 kB)
     |████████████████████████████████| 118 kB 18.2 MB/s 
Installing collected packages: pycparser, cffi, enum34, ipaddress, cryptography, pyopenssl
Successfully installed cffi-1.15.1 cryptography-3.3.2 enum34-1.1.10 ipaddress-1.0.23 pycparser-2.21 pyopenssl-21.0.0
                                                                                                                                                                                                                   
┌──(g0at㉿kali)-[~/Desktop]
└─$ pip2 install twisted
DEPRECATION: Python 2.7 reached the end of its life on January 1st, 2020. Please upgrade your Python as Python 2.7 is no longer maintained. pip 21.0 will drop support for Python 2.7 in January 2021. More details about Python 2 support in pip can be found at https://pip.pypa.io/en/latest/development/release-process/#python-2-support pip 21.0 will remove support for this functionality.                                    
Defaulting to user installation because normal site-packages is not writeable
Collecting twisted
  Downloading Twisted-20.3.0-cp27-cp27mu-manylinux1_x86_64.whl (3.2 MB)
     |████████████████████████████████| 3.2 MB 396 kB/s 
Collecting zope.interface>=4.4.2
  Downloading zope.interface-5.5.2.tar.gz (300 kB)
     |████████████████████████████████| 300 kB 2.5 MB/s 
Collecting attrs>=19.2.0
  Downloading attrs-21.4.0-py2.py3-none-any.whl (60 kB)
     |████████████████████████████████| 60 kB 3.8 MB/s 
Collecting hyperlink>=17.1.1
  Downloading hyperlink-21.0.0-py2.py3-none-any.whl (74 kB)
     |████████████████████████████████| 74 kB 1.0 MB/s 
Collecting constantly>=15.1
  Downloading constantly-15.1.0-py2.py3-none-any.whl (7.9 kB)
Collecting Automat>=0.3.0
  Downloading Automat-22.10.0-py2.py3-none-any.whl (26 kB)
Requirement already satisfied: PyHamcrest!=1.10.0,>=1.9.0 in /home/g0at/.local/lib/python2.7/site-packages (from twisted) (1.10.1)
Collecting incremental>=16.10.1
  Downloading incremental-22.10.0-py2.py3-none-any.whl (16 kB)
Requirement already satisfied: setuptools in /usr/local/lib/python2.7/dist-packages (from zope.interface>=4.4.2->twisted) (44.1.1)
Collecting idna>=2.5
  Downloading idna-2.10-py2.py3-none-any.whl (58 kB)
     |████████████████████████████████| 58 kB 4.6 MB/s 
Collecting typing; python_version < "3.5"
  Downloading typing-3.10.0.0-py2-none-any.whl (26 kB)
Requirement already satisfied: six in /home/g0at/.local/lib/python2.7/site-packages (from Automat>=0.3.0->twisted) (1.16.0)
Building wheels for collected packages: zope.interface
  Building wheel for zope.interface (setup.py) ... done
  Created wheel for zope.interface: filename=zope.interface-5.5.2-cp27-cp27mu-linux_x86_64.whl size=198975 sha256=c18b24a79ba85066a8b982b2f624c23b285a56618aae08f309f200f02383a5f2
  Stored in directory: /home/g0at/.cache/pip/wheels/8f/60/b0/736e361327f969f38ad9ee2e24132600a82fac63ab43b7082e
Successfully built zope.interface
Installing collected packages: zope.interface, attrs, idna, typing, hyperlink, constantly, Automat, incremental, twisted
  WARNING: The script automat-visualize is installed in '/home/g0at/.local/bin' which is not on PATH.
  Consider adding this directory to PATH or, if you prefer to suppress this warning, use #no-warn-script-location.                                                                                                
  WARNING: The scripts cftp, ckeygen, conch, mailmail, pyhtmlizer, tkconch, trial, twist and twistd are installed in '/home/g0at/.local/bin' which is not on PATH.
  Consider adding this directory to PATH or, if you prefer to suppress this warning, use #no-warn-script-location.                                                                                                
Successfully installed Automat-22.10.0 attrs-21.4.0 constantly-15.1.0 hyperlink-21.0.0 idna-2.10 incremental-22.10.0 twisted-20.3.0 typing-3.10.0.0 zope.interface-5.5.2
                                                                                                                                                                                                                   
┌──(g0at㉿kali)-[~/Desktop]
└─$ pip2 install service_identity
DEPRECATION: Python 2.7 reached the end of its life on January 1st, 2020. Please upgrade your Python as Python 2.7 is no longer maintained. pip 21.0 will drop support for Python 2.7 in January 2021. More details about Python 2 support in pip can be found at https://pip.pypa.io/en/latest/development/release-process/#python-2-support pip 21.0 will remove support for this functionality.                                    
Defaulting to user installation because normal site-packages is not writeable
Collecting service_identity
  Downloading service_identity-21.1.0-py2.py3-none-any.whl (12 kB)
Collecting pyasn1-modules
  Downloading pyasn1_modules-0.3.0-py2.py3-none-any.whl (181 kB)
     |████████████████████████████████| 181 kB 456 kB/s 
Collecting pyasn1
  Downloading pyasn1-0.5.1-py2.py3-none-any.whl (84 kB)
     |████████████████████████████████| 84 kB 3.5 MB/s 
Requirement already satisfied: cryptography in /home/g0at/.local/lib/python2.7/site-packages (from service_identity) (3.3.2)
Requirement already satisfied: six in /home/g0at/.local/lib/python2.7/site-packages (from service_identity) (1.16.0)
Requirement already satisfied: attrs>=19.1.0 in /home/g0at/.local/lib/python2.7/site-packages (from service_identity) (21.4.0)
Requirement already satisfied: ipaddress; python_version < "3.3" in /home/g0at/.local/lib/python2.7/site-packages (from service_identity) (1.0.23)
Requirement already satisfied: cffi>=1.12 in /home/g0at/.local/lib/python2.7/site-packages (from cryptography->service_identity) (1.15.1)
Requirement already satisfied: enum34; python_version < "3" in /home/g0at/.local/lib/python2.7/site-packages (from cryptography->service_identity) (1.1.10)
Requirement already satisfied: pycparser in /home/g0at/.local/lib/python2.7/site-packages (from cffi>=1.12->cryptography->service_identity) (2.21)
Installing collected packages: pyasn1, pyasn1-modules, service-identity
Successfully installed pyasn1-0.5.1 pyasn1-modules-0.3.0 service-identity-21.1.0
                                                                                                                                                                                                                                                                                                                                                                                                                                  
┌──(g0at㉿kali)-[~/Desktop]
└─$ sudo apt-get install #assume-yes openjdk-8-jdk-headless
正在读取软件包列表... 完成
正在分析软件包的依赖关系树... 完成
正在读取状态信息... 完成                 
E: 无法定位软件包 openjdk-8-jdk-headless
                                                                                                                                                                                                                                                                                                                                                                                                                                 
┌──(g0at㉿kali)-[~/Desktop]
└─$ java -Version
Picked up _JAVA_OPTIONS: -Dawt.useSystemAAFontSettings=on -Dswing.aatext=true
Unrecognized option: -Version
Error: Could not create the Java Virtual Machine.
Error: A fatal exception has occurred. Program will exit.
                                                                                                                                                                                                                   
┌──(g0at㉿kali)-[~/Desktop]
└─$ javac -version
Picked up _JAVA_OPTIONS: -Dawt.useSystemAAFontSettings=on -Dswing.aatext=true
javac 17.0.8
                                                                                                                                                                                                                                                                                                                                                                                                                                    
┌──(g0at㉿kali)-[~/Desktop]
└─$ sudo pip2 install drozer-2.4.4-py2-none-any.whl         
DEPRECATION: Python 2.7 reached the end of its life on January 1st, 2020. Please upgrade your Python as Python 2.7 is no longer maintained. pip 21.0 will drop support for Python 2.7 in January 2021. More details about Python 2 support in pip can be found at https://pip.pypa.io/en/latest/development/release-process/#python-2-support pip 21.0 will remove support for this functionality.                                    
Processing ./drozer-2.4.4-py2-none-any.whl
Collecting pyyaml>=3.11
  Downloading PyYAML-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl (574 kB)
     |████████████████████████████████| 574 kB 466 kB/s 
Collecting protobuf>=2.6.1
  Downloading protobuf-3.17.3-cp27-cp27mu-manylinux_2_5_x86_64.manylinux1_x86_64.whl (1.0 MB)
     |████████████████████████████████| 1.0 MB 6.3 MB/s 
Collecting pyopenssl>=16.2
  Downloading pyOpenSSL-21.0.0-py2.py3-none-any.whl (55 kB)
     |████████████████████████████████| 55 kB 2.2 MB/s 
Collecting six>=1.9
  Downloading six-1.16.0-py2.py3-none-any.whl (11 kB)
Collecting cryptography>=3.3
  Downloading cryptography-3.3.2-cp27-cp27mu-manylinux2010_x86_64.whl (2.6 MB)
     |████████████████████████████████| 2.6 MB 2.3 MB/s 
Collecting cffi>=1.12
  Downloading cffi-1.15.1-cp27-cp27mu-manylinux1_x86_64.whl (390 kB)
     |████████████████████████████████| 390 kB 22.1 MB/s 
Collecting enum34; python_version < "3"
  Downloading enum34-1.1.10-py2-none-any.whl (11 kB)
Collecting ipaddress; python_version < "3"
  Downloading ipaddress-1.0.23-py2.py3-none-any.whl (18 kB)
Collecting pycparser
  Downloading pycparser-2.21-py2.py3-none-any.whl (118 kB)
     |████████████████████████████████| 118 kB 9.4 MB/s 
Installing collected packages: pyyaml, six, protobuf, pycparser, cffi, enum34, ipaddress, cryptography, pyopenssl, drozer
Successfully installed cffi-1.15.1 cryptography-3.3.2 drozer-2.4.4 enum34-1.1.10 ipaddress-1.0.23 protobuf-3.17.3 pycparser-2.21 pyopenssl-21.0.0 pyyaml-5.4.1 six-1.16.0
                                                                                                                                                                                                                   
┌──(g0at㉿kali)-[~/Desktop]
└─$ drozer
usage: drozer [COMMAND]

Run `drozer [COMMAND] #help` for more usage information.

Commands:
          console  start the drozer Console
           module  manage drozer modules
           server  start a drozer Server
              ssl  manage drozer SSL key material
          exploit  generate an exploit to deploy drozer
            agent  create custom drozer Agents
          payload  generate payloads to deploy droze

┌──(g0at㉿kali)-[~/Desktop]
└─$ adb install drozer-agent-2.3.4.apk   #安装完APP后需要在Android侧打开drozer                       
Performing Streamed Install
Success
                                                                        
┌──(g0at㉿kali)-[~/Desktop]
└─$ adb forward tcp:31415 tcp:31415   #设置端口转发
31415
                                                                        
┌──(g0at㉿kali)-[~/Desktop]
└─$ drozer console connect         #启动Drozer
/home/g0at/.local/lib/python2.7/site-packages/OpenSSL/crypto.py:14: CryptographyDeprecationWarning: Python 2 is no longer supported by the Python core team. Support for it is now deprecated in cryptography, and will be removed in the next release.
  from cryptography import utils, x509
Selecting 2abfc75c6bf43736 (Qualcomm Zeekr DHU for arm64 12)

            ..                    ..:.
           ..o..                  .r..
            ..a..  . ....... .  ..nd
              ro..idsnemesisand..pr
              .otectorandroidsneme.
           .,sisandprotectorandroids+.
         ..nemesisandprotectorandroidsn:.
        .emesisandprotectorandroidsnemes..
      ..isandp,..,rotectorandro,..,idsnem.
      .isisandp..rotectorandroid..snemisis.
      ,andprotectorandroidsnemisisandprotec.
     .torandroidsnemesisandprotectorandroid.
     .snemisisandprotectorandroidsnemesisan:
     .dprotectorandroidsnemesisandprotector.

drozer Console (v2.4.4)
dz>

报错及相应的解决方案：https://blog.csdn.net/Jession_Ding/article/details/82528142

Windows

在 Windows 下，安装环境必须为 Python 2.7，安装时选择自动添加环境变量，安装drozer时指定Python2安装路径，drozer 成功安装后，软件位于 Python 2.7 下的 Scripts 目录下。

1
2
3
4
5
pip2 install protobuf -i https://pypi.tuna.tsinghua.edu.cn/simple
pip2 install pyopenssl -i https://pypi.tuna.tsinghua.edu.cn/simple
pip2 install pyyaml -i https://pypi.tuna.tsinghua.edu.cn/simple
pip2 install twisted -i https://pypi.tuna.tsinghua.edu.cn/simple
pip2 install service_identity -i https://pypi.tuna.tsinghua.edu.cn/simple

后面具体运行就和Linux一样了，更推荐在Linux下运行。

四大组件

具体测试流程不方便贴出来）

Activity

漏洞种类 危害
越权绕过 Activity 用户界面绕过会造成用户信息窃取
拒绝服务 通过 Intent 给 Activity 传输畸形数据使得程序崩溃从而影响用户体验
Activity 劫持 组件导出导致钓鱼欺诈，Activity 界面被劫持产生欺诈等安全事件
隐式启动 Intent 包含敏感数据 敏感信息泄露

Conten Provider

数据共享组件，用于向其他组件乃至其他应用共享数据，所以该组件漏洞与数据相关。

漏洞种类 危害
信息泄露 查看组件数据信息
SQL注入 注入获取相关数据
目录遍历 访问任意可读文件

Broadcast Receiver

漏洞种类 危害
敏感信息泄露 发送的intent没有明确指定接收者，而是简单的通过action进行匹配，恶意应用便可以注册一个广播接收者嗅探拦截到这个广播，如果这个广播存在敏感数据，就被恶意应用窃取了。
权限绕过 可以通过两种方式注册广播接收器，一种是在AndroidManifest.xml文件中通过标签静态注册，另一种是通过Context.registerReceiver()动态注册，指定相应的intentFilter参数，动态注册的广播默认都是导出的，如果导出的BroadcastReceiver没有做权限控制，导致BroadcastReceiver组件可以接收一个外部可控的url、或者其他命令，导致攻击者可以越权利用应用的一些特定功能，比如发送恶意广播、伪造消息、任意应用下载安装、打开钓鱼网站等
消息伪造 暴露的Receiver对外接收Intent，如果构造恶意的消息放在Intent中传输，被调用的Receiver接收可能产生安全隐患
拒绝服务 如果敏感的BroadcastReceiver没有设置相应的权限保护，很容易受到攻击。最常见的是拒绝服务攻击。拒绝服务攻击指的是，传递恶意畸形的intent数据给广播接收器，广播接收器无法处理异常导致crash。 拒绝服务攻击的危害视具体业务场景而定，比如一个安全防护产品的拒绝服务、锁屏应用的拒绝服务、支付进程的拒绝服务等危害就是巨大的。

Service

Service(服务)是一个一种可以在后台执行长时间运行操作而没有用户界面的应用组件。服务可由其他应用组件启动（如Activity），服务一旦被启动将在后台一直运行，即使启动服务的组件（Activity）已销毁也不受影响。 此外，组件可以绑定到服务，以与之进行交互，甚至是执行进程间通信 (IPC)。

漏洞种类 危害
权限提升 当一个service配置了intent-filter默认是被导出的，如果没对调用Service进行权限，限制或者是没有对调用者的身份进行有效验证，那么恶意构造的APP都可以对此Service传入恰当的参数进行调用，导致恶意行为发生比如调用具有system权限的删除卸载服务删除卸载其他应用。
service劫持 隐式启动services,当存在同名services,先安装应用的services优先级高
消息伪造 暴露的Service对外接收Intent，如果构造恶意的消息放在Intent中传输，被调用的Service接收可能产生安全隐患
拒绝服务 Service的拒绝服务主要来源于Service启动时对接收的Intent等没有做异常情况下的处理，导致程序崩溃

拓展

模块说明

Activity
1
2
3
4
app.activity.forintent # 找到可以处理已指定的包
app.activity.info # 获取activity组件信息
app.activity.start # 开启activity组件
scanner.activity.browsable # 获取可从web浏览器调用的所有可浏览的activity组件
Service
1
2
3
4
app.service.info # 获取service组件信息
app.service.send # 向服务组件发送消息并显示答复
app.service.start # 开启service组件
app.service.stop # 停止service组件
Content Provider
1
2
3
4
5
6
7
8
9
10
11
12
13
app.provider.columns # 在内容提供程序中列出列
app.provider.delete # 在内容提供程序中删除
app.provider.download # 在内容提供程序中下载支持文件
app.provider.finduri # 在包中查找引用的内容URIS
app.provider.info # 获取Content Provider组件信息
app.provider.insert # 插入到Content Provider组件中
app.provider.query # 查询Content Provider组件
app.provider.read # 从支持文件的Content Provider读取
app.provider.update # 更新Content Provider的记录
scanner.provider.finduris # 搜索可从上下文中查询的Content Provider
scanner.provider.injection # 测试Content Provider的注入漏洞
scanner.provider.sqltables # 查找可通过SQL注入漏洞访问的表
scanner.provider.traversal # 测试Content Provider的基本目录遍历漏洞
Broadcast Receivers
1
2
3
app.broadcast.info # 获取有关广播接收器的信息
app.broadcast.send # 带目的发送广播
app.broadcast.sniff # 注册一个能嗅出特定意图的广播接收器
获取APP包信息
1
2
3
4
5
6
7
8
9
app.package.attacksurface #获取包攻击面
app.package.backup #列出使用备份API的包(在标记“允许备份”时返回true)
app.package.debuggable #查找可调试包
app.package.info #获取有关已安装软件包的信息
app.package.launchintent #获取包的启动意图
app.package.list #列出程序包
app.package.manifest #获取包的AndroidManifest.xml
app.package.native #查找嵌入在应用程序中的本地库
app.package.shareduid #查找具有共享uid的包

一些命令

通过app.package.list模块获取要检测的app的包名
dz> run app.package.list -f filter_str
查看指定 apk 信息（版本，数据库存储目录，权限信息等）
dz> run app.package.info -a <package_name>
使用app.package.attacksurface模块识别攻击面
dz> run app.package.attacksurface <package_name>
使用app.activity.info模块查看activity组件信息
dz> run app.activity.info -a <package_name>
使用app.provider.info模块查看content provider组件信息
dz> run app.provider.info -a <package_name>
使用app.service.info模块查看service组件信息
dz> run app.service.info -a <package_name>
使用scanner.provider.injection 扫描是否有 sql 注入
dz> run scanner.provider.injection -a <package_name>
使用scanner.provider.finduris扫描访问 content provider 的URI（数据泄露）
dz> run scanner.provider.finduris -a <package_name>
获取指定应用的导出组件
dz> run app.activity.info -a <package_name>
dz> run app.service.info -a <package_name>
dz> run app.broadcast.info -a <package_name>
dz> run scanner.provider.finduris -a <package_name>

Android
#IoV #Android
Drozer指北
https://g1at.github.io/2024/01/27/Drozer/
作者
g0at
发布于
2024年1月27日
许可协议