┌──(g0at㉿kali)-[~/Desktop] └─$ pip2 install wheel DEPRECATION: Python 2.7 reached the end of its life on January 1st, 2020. Please upgrade your Python as Python 2.7 is no longer maintained. pip 21.0 will drop support for Python 2.7 in January 2021. More details about Python 2 support in pip can be found at https://pip.pypa.io/en/latest/development/release-process/#python-2-support pip 21.0 will remove support for this functionality. Defaulting to user installation because normal site-packages is not writeable Requirement already satisfied: wheel in /usr/local/lib/python2.7/dist-packages (0.37.1)
┌──(g0at㉿kali)-[~/Desktop] └─$ pip2 install pyyaml DEPRECATION: Python 2.7 reached the end of its life on January 1st, 2020. Please upgrade your Python as Python 2.7 is no longer maintained. pip 21.0 will drop support for Python 2.7 in January 2021. More details about Python 2 support in pip can be found at https://pip.pypa.io/en/latest/development/release-process/#python-2-support pip 21.0 will remove support for this functionality. Defaulting to user installation because normal site-packages is not writeable Collecting pyyaml Downloading PyYAML-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl (574 kB) |████████████████████████████████| 574 kB 436 kB/s Installing collected packages: pyyaml Successfully installed pyyaml-5.4.1
┌──(g0at㉿kali)-[~/Desktop] └─$ pip2 install pyhamcrest DEPRECATION: Python 2.7 reached the end of its life on January 1st, 2020. Please upgrade your Python as Python 2.7 is no longer maintained. pip 21.0 will drop support for Python 2.7 in January 2021. More details about Python 2 support in pip can be found at https://pip.pypa.io/en/latest/development/release-process/#python-2-support pip 21.0 will remove support for this functionality. Defaulting to user installation because normal site-packages is not writeable Collecting pyhamcrest Downloading PyHamcrest-1.10.1.tar.gz (43 kB) |████████████████████████████████| 43 kB 252 kB/s Collecting six Downloading six-1.16.0-py2.py3-none-any.whl (11 kB) Building wheels for collected packages: pyhamcrest Building wheel for pyhamcrest (setup.py) ... done Created wheel for pyhamcrest: filename=PyHamcrest-1.10.1-py2-none-any.whl size=48898 sha256=7d5493ff342fd5ea5ec10a6d8713f7519bfcf4cc98d1b101cb75039f15e76e43 Stored in directory: /home/g0at/.cache/pip/wheels/f5/8c/e2/f0cea19d340270166bbfd4a2e9d8b8c132e26ef7e1376a0890 Successfully built pyhamcrest Installing collected packages: six, pyhamcrest Successfully installed pyhamcrest-1.10.1 six-1.16.0
┌──(g0at㉿kali)-[~/Desktop] └─$ pip2 install protobuf DEPRECATION: Python 2.7 reached the end of its life on January 1st, 2020. Please upgrade your Python as Python 2.7 is no longer maintained. pip 21.0 will drop support for Python 2.7 in January 2021. More details about Python 2 support in pip can be found at https://pip.pypa.io/en/latest/development/release-process/#python-2-support pip 21.0 will remove support for this functionality. Defaulting to user installation because normal site-packages is not writeable Collecting protobuf Downloading protobuf-3.17.3-cp27-cp27mu-manylinux_2_5_x86_64.manylinux1_x86_64.whl (1.0 MB) |████████████████████████████████| 1.0 MB 349 kB/s Requirement already satisfied: six>=1.9 in /home/g0at/.local/lib/python2.7/site-packages (from protobuf) (1.16.0) Installing collected packages: protobuf Successfully installed protobuf-3.17.3
┌──(g0at㉿kali)-[~/Desktop] └─$ pip2 install pyopenssl DEPRECATION: Python 2.7 reached the end of its life on January 1st, 2020. Please upgrade your Python as Python 2.7 is no longer maintained. pip 21.0 will drop support for Python 2.7 in January 2021. More details about Python 2 support in pip can be found at https://pip.pypa.io/en/latest/development/release-process/#python-2-support pip 21.0 will remove support for this functionality. Defaulting to user installation because normal site-packages is not writeable Collecting pyopenssl Downloading pyOpenSSL-21.0.0-py2.py3-none-any.whl (55 kB) |████████████████████████████████| 55 kB 304 kB/s Collecting cryptography>=3.3 Downloading cryptography-3.3.2-cp27-cp27mu-manylinux2010_x86_64.whl (2.6 MB) |████████████████████████████████| 2.6 MB 686 kB/s Requirement already satisfied: six>=1.5.2 in /home/g0at/.local/lib/python2.7/site-packages (from pyopenssl) (1.16.0) Collecting cffi>=1.12 Downloading cffi-1.15.1-cp27-cp27mu-manylinux1_x86_64.whl (390 kB) |████████████████████████████████| 390 kB 4.8 MB/s Collecting enum34; python_version < "3" Downloading enum34-1.1.10-py2-none-any.whl (11 kB) Collecting ipaddress; python_version < "3" Downloading ipaddress-1.0.23-py2.py3-none-any.whl (18 kB) Collecting pycparser Downloading pycparser-2.21-py2.py3-none-any.whl (118 kB) |████████████████████████████████| 118 kB 18.2 MB/s Installing collected packages: pycparser, cffi, enum34, ipaddress, cryptography, pyopenssl Successfully installed cffi-1.15.1 cryptography-3.3.2 enum34-1.1.10 ipaddress-1.0.23 pycparser-2.21 pyopenssl-21.0.0
┌──(g0at㉿kali)-[~/Desktop] └─$ pip2 install twisted DEPRECATION: Python 2.7 reached the end of its life on January 1st, 2020. Please upgrade your Python as Python 2.7 is no longer maintained. pip 21.0 will drop support for Python 2.7 in January 2021. More details about Python 2 support in pip can be found at https://pip.pypa.io/en/latest/development/release-process/#python-2-support pip 21.0 will remove support for this functionality. Defaulting to user installation because normal site-packages is not writeable Collecting twisted Downloading Twisted-20.3.0-cp27-cp27mu-manylinux1_x86_64.whl (3.2 MB) |████████████████████████████████| 3.2 MB 396 kB/s Collecting zope.interface>=4.4.2 Downloading zope.interface-5.5.2.tar.gz (300 kB) |████████████████████████████████| 300 kB 2.5 MB/s Collecting attrs>=19.2.0 Downloading attrs-21.4.0-py2.py3-none-any.whl (60 kB) |████████████████████████████████| 60 kB 3.8 MB/s Collecting hyperlink>=17.1.1 Downloading hyperlink-21.0.0-py2.py3-none-any.whl (74 kB) |████████████████████████████████| 74 kB 1.0 MB/s Collecting constantly>=15.1 Downloading constantly-15.1.0-py2.py3-none-any.whl (7.9 kB) Collecting Automat>=0.3.0 Downloading Automat-22.10.0-py2.py3-none-any.whl (26 kB) Requirement already satisfied: PyHamcrest!=1.10.0,>=1.9.0 in /home/g0at/.local/lib/python2.7/site-packages (from twisted) (1.10.1) Collecting incremental>=16.10.1 Downloading incremental-22.10.0-py2.py3-none-any.whl (16 kB) Requirement already satisfied: setuptools in /usr/local/lib/python2.7/dist-packages (from zope.interface>=4.4.2->twisted) (44.1.1) Collecting idna>=2.5 Downloading idna-2.10-py2.py3-none-any.whl (58 kB) |████████████████████████████████| 58 kB 4.6 MB/s Collecting typing; python_version < "3.5" Downloading typing-3.10.0.0-py2-none-any.whl (26 kB) Requirement already satisfied: six in /home/g0at/.local/lib/python2.7/site-packages (from Automat>=0.3.0->twisted) (1.16.0) Building wheels for collected packages: zope.interface Building wheel for zope.interface (setup.py) ... done Created wheel for zope.interface: filename=zope.interface-5.5.2-cp27-cp27mu-linux_x86_64.whl size=198975 sha256=c18b24a79ba85066a8b982b2f624c23b285a56618aae08f309f200f02383a5f2 Stored in directory: /home/g0at/.cache/pip/wheels/8f/60/b0/736e361327f969f38ad9ee2e24132600a82fac63ab43b7082e Successfully built zope.interface Installing collected packages: zope.interface, attrs, idna, typing, hyperlink, constantly, Automat, incremental, twisted WARNING: The script automat-visualize is installed in'/home/g0at/.local/bin'which is not on PATH. Consider adding this directory to PATH or, if you prefer to suppress this warning, use #no-warn-script-location. WARNING: The scripts cftp, ckeygen, conch, mailmail, pyhtmlizer, tkconch, trial, twist and twistd are installed in'/home/g0at/.local/bin'which is not on PATH. Consider adding this directory to PATH or, if you prefer to suppress this warning, use #no-warn-script-location. Successfully installed Automat-22.10.0 attrs-21.4.0 constantly-15.1.0 hyperlink-21.0.0 idna-2.10 incremental-22.10.0 twisted-20.3.0 typing-3.10.0.0 zope.interface-5.5.2
┌──(g0at㉿kali)-[~/Desktop] └─$ pip2 install service_identity DEPRECATION: Python 2.7 reached the end of its life on January 1st, 2020. Please upgrade your Python as Python 2.7 is no longer maintained. pip 21.0 will drop support for Python 2.7 in January 2021. More details about Python 2 support in pip can be found at https://pip.pypa.io/en/latest/development/release-process/#python-2-support pip 21.0 will remove support for this functionality. Defaulting to user installation because normal site-packages is not writeable Collecting service_identity Downloading service_identity-21.1.0-py2.py3-none-any.whl (12 kB) Collecting pyasn1-modules Downloading pyasn1_modules-0.3.0-py2.py3-none-any.whl (181 kB) |████████████████████████████████| 181 kB 456 kB/s Collecting pyasn1 Downloading pyasn1-0.5.1-py2.py3-none-any.whl (84 kB) |████████████████████████████████| 84 kB 3.5 MB/s Requirement already satisfied: cryptography in /home/g0at/.local/lib/python2.7/site-packages (from service_identity) (3.3.2) Requirement already satisfied: six in /home/g0at/.local/lib/python2.7/site-packages (from service_identity) (1.16.0) Requirement already satisfied: attrs>=19.1.0 in /home/g0at/.local/lib/python2.7/site-packages (from service_identity) (21.4.0) Requirement already satisfied: ipaddress; python_version < "3.3"in /home/g0at/.local/lib/python2.7/site-packages (from service_identity) (1.0.23) Requirement already satisfied: cffi>=1.12 in /home/g0at/.local/lib/python2.7/site-packages (from cryptography->service_identity) (1.15.1) Requirement already satisfied: enum34; python_version < "3"in /home/g0at/.local/lib/python2.7/site-packages (from cryptography->service_identity) (1.1.10) Requirement already satisfied: pycparser in /home/g0at/.local/lib/python2.7/site-packages (from cffi>=1.12->cryptography->service_identity) (2.21) Installing collected packages: pyasn1, pyasn1-modules, service-identity Successfully installed pyasn1-0.5.1 pyasn1-modules-0.3.0 service-identity-21.1.0
┌──(g0at㉿kali)-[~/Desktop] └─$ java -Version Picked up _JAVA_OPTIONS: -Dawt.useSystemAAFontSettings=on -Dswing.aatext=true Unrecognized option: -Version Error: Could not create the Java Virtual Machine. Error: A fatal exception has occurred. Program will exit.
Run `drozer [COMMAND] #help` for more usage information.
Commands: console start the drozer Console module manage drozer modules server start a drozer Server ssl manage drozer SSL key material exploit generate an exploit to deploy drozer agent create custom drozer Agents payload generate payloads to deploy droze
┌──(g0at㉿kali)-[~/Desktop] └─$ drozer console connect #启动Drozer /home/g0at/.local/lib/python2.7/site-packages/OpenSSL/crypto.py:14: CryptographyDeprecationWarning: Python 2 is no longer supported by the Python core team. Support for it is now deprecated in cryptography, and will be removed in the next release. from cryptography import utils, x509 Selecting 2abfc75c6bf43736 (Qualcomm Zeekr DHU for arm64 12)
run app.package.list -f sieve run app.package.info -a com.withsecure.example.sieve run app.package.attacksurface com.withsecure.example.sieve run app.package.manifest com.withsecure.example.sieve
app.package.attacksurface 接收位置参数，而 app.package.info 使用 -a，这是很容易混用的一处。各模块参数不是统一模板，有疑问就执行 help 模块名。
run app.activity.info -a com.withsecure.example.sieve help app.activity.start run app.activity.start --component com.withsecure.example.sieve com.withsecure.example.sieve.activity.PWList
run app.provider.info -a com.withsecure.example.sieve run scanner.provider.finduris -a com.withsecure.example.sieve run app.provider.query content://com.withsecure.example.sieve.provider.DBContentProvider/Passwords/ --vertical
这条 URI 来自官方 Sieve 示例。换目标时应先获得实际 authority、path 和匹配规则，再构造查询。扫描器没有发现 URI，可能只是猜测范围或可见性受限，不能据此证明 Provider 安全。
层次
需要确认的内容
组件
exported、全局 readPermission/writePermission
路径
path-permission、UriMatcher、末尾斜杠、编码与规范化
数据操作
query/insert/update/delete/openFile 是否各自受控
SQL 构造
projection、selection、sortOrder 是否有白名单和正确绑定
返回结果
实际返回哪些列、行、文件；是否超出调用者权限
Sieve 的教学价值之一，是说明“有权限声明”与“每条访问路径都被权限覆盖”之间的差别。例如精确路径 /Keys 与 /Keys/ 是否落入同一权限规则，必须结合 Manifest 和 URI 路由分析，不能凭界面显示的一个权限名下结论。
run app.broadcast.info -a com.withsecure.example.sieve run app.service.info -a com.withsecure.example.sieve help app.broadcast.send help app.service.send
通过app.package.list模块获取要检测的app的包名 dz> run app.package.list -f filter_str 查看指定 apk 信息（版本，数据库存储目录，权限信息等） dz> run app.package.info -a <package_name> 使用app.package.attacksurface模块识别攻击面 dz> run app.package.attacksurface <package_name> 使用app.activity.info模块查看activity组件信息 dz> run app.activity.info -a <package_name> 使用app.provider.info模块查看content provider组件信息 dz> run app.provider.info -a <package_name> 使用app.service.info模块查看service组件信息 dz> run app.service.info -a <package_name> 使用scanner.provider.injection 扫描是否有 sql 注入 dz> run scanner.provider.injection -a <package_name> 使用scanner.provider.finduris扫描访问 content provider 的URI（数据泄露） dz> run scanner.provider.finduris -a <package_name> 获取指定应用的导出组件 dz> run app.activity.info -a <package_name> dz> run app.service.info -a <package_name> dz> run app.broadcast.info -a <package_name> dz> run scanner.provider.finduris -a <package_name>
