Drozer is an android application security testing framework which is developed by FSecureLABS that makes it easy for a Pen-tester to check for potential vulnerabilities in the components of an application. It was in the past known as Mercury. It Works by playing the part of a local Android application and interfacing with the Dalvik Virtual Machine.
In this blog, I will illustrate the installation of Drozer in Kali Linux. It is a straightforward Installation.
Information Gathering on Device:
Drozer has built-in modules to fetch the date and time of the device and some other information of the device also, run “run information.datetime” in the terminal.
Run the following command to check the packages which are debuggable run app.package.debuggable.
Run The following command to get the androidmanifest.xml file.
“run app.package.manifestjakhar.aseem.diva”
This feature of drozer will help us to identify the possible attack surface on the application. Android applications have mainly 4 essential components that can be exploited along with the debuggable flag. Run the following command to get the attack surface of any android application with a package name.
“run app.package.attacksurfacejakhar.aseem.diva”
Exploiting Activities:
“run app.activity.info -a jakhar.aseem.diva”
“run app.activity.start –component jakhar.aseem.divajakhar.aseem.diva.APICredsActivity”
“run app.provider.info -a jakhar.aseem.diva”
“run app.provider.query” with the content URI as shown in the below screenshot.
In this blog, we looked at various use cases of drozer framework and how drozer can help in android vulnerability assessment and various attacks that pose serious security issues to the applications. We explored the attack surface on the application, exploited exported components of the application and performed SQL injection, etc. Thanks for reading.
Author,
Piyush Sonkushre
Attack & Pentest Team
Varutra Consulting Pvt.Ltd.
Introduction In the era of digitalization, data security has become a paramount concern. Every day,…
I.Introduction Bluetooth has become an integral technology for billions of smartphones, computers, wearables, and other…
I. Introduction In today's ever-evolving cybersecurity landscape, staying ahead of adversaries has become a challenge.…
Introduction In an increasingly interconnected world, the financial industry is becoming more vulnerable to cyber…
Introduction In today's interconnected world, where smartphones are an extension of our lives, ensuring the…
Introduction Unseen and unpredictable, zero-day threats loom as a constant menace to modern businesses. Detecting…