drozer는 안드로이드 앱 진단도구로 많이 사용되고 있다.

1. PC에 설치.
https://www.mwrinfosecurity.com/products/drozer/community-edition/ 에서 다운로드.
drozer-installer-2.3.3.zip 사용자 PC에 설치(windows 용)

path 잡아주고 실행하면 끝!

C:\>drozer.bat
usage: drozer [COMMAND]

Run `drozer [COMMAND] --help` for more usage information.

Commands:
          console  start the drozer Console
           module  manage drozer modules
           server  start a drozer Server
              ssl  manage drozer SSL key material
          exploit  generate an exploit to deploy drozer
            agent  create custom drozer Agents
          payload  generate payloads to deploy drozer

2. drozer 앱 을 안드로이드 폰에 설치
좀전에 다운받은 drozer-installer-2.3.3.zip 안에 agent.apk 가 있으니 설치.

C:\> adb install agent.apk

실행화면.

3. 연결

C:\>adb forward tcp:31415 tcp:31415

C:\>drozer.bat console connect
Could not find java. Please ensure that it is installed and on your PATH.

If this error persists, specify the path in the ~/.drozer_config file:

    [executables]
    java = C:\path\to\java
Selecting XXXXXXXXXXXXXXXX (samsung XX-XXXXX X.0)

            ..                    ..:.
           ..o..                  .r..
            ..a..  . ....... .  ..nd
              ro..idsnemesisand..pr
              .otectorandroidsneme.
           .,sisandprotectorandroids+.
         ..nemesisandprotectorandroidsn:.
        .emesisandprotectorandroidsnemes..
      ..isandp,..,rotectorandro,..,idsnem.
      .isisandp..rotectorandroid..snemisis.
      ,andprotectorandroidsnemisisandprotec.
     .torandroidsnemesisandprotectorandroid.
     .snemisisandprotectorandroidsnemesisan:
     .dprotectorandroidsnemesisandprotector.

drozer Console (v2.3.3)
dz>

C:\Users\사용자\.drozer_config 파일 추가

[executables]
java = C:\Program Files\Java\jdk1.8.0_20

다시 실행

C:\>drozer.bat console connect
Selecting XXXXXXXXXXXXXXXX (samsung XX-XXXXX X.0)

            ..                    ..:.
           ..o..                  .r..
            ..a..  . ....... .  ..nd
              ro..idsnemesisand..pr
              .otectorandroidsneme.
           .,sisandprotectorandroids+.
         ..nemesisandprotectorandroidsn:.
        .emesisandprotectorandroidsnemes..
      ..isandp,..,rotectorandro,..,idsnem.
      .isisandp..rotectorandroid..snemisis.
      ,andprotectorandroidsnemisisandprotec.
     .torandroidsnemesisandprotectorandroid.
     .snemisisandprotectorandroidsnemesisan:
     .dprotectorandroidsnemesisandprotector.

drozer Console (v2.3.3)
dz>
dz> ls
app.activity.forintent                   Find activities that can handle the given intent
app.activity.info                        Gets information about exported activities.
app.activity.start                       Start an Activity
app.broadcast.info                       Get information about broadcast receivers
app.broadcast.send                       Send broadcast using an intent
app.package.attacksurface                Get attack surface of package
app.package.backup                       Lists packages that use the backup API (returns true on FLAG_ALLOW_BACKUP)
app.package.debuggable                   Find debuggable packages
app.package.info                         Get information about installed packages
app.package.launchintent                 Get launch intent of package
app.package.list                         List Packages
app.package.manifest                     Get AndroidManifest.xml of package
app.package.native                       Find Native libraries embedded in the application.
app.package.shareduid                    Look for packages with shared UIDs
app.provider.columns                     List columns in content provider
app.provider.delete                      Delete from a content provider
app.provider.download                    Download a file from a content provider that supports files
app.provider.finduri                     Find referenced content URIs in a package
app.provider.info                        Get information about exported content providers
app.provider.insert                      Insert into a Content Provider
app.provider.query                       Query a content provider
app.provider.read                        Read from a content provider that supports files
app.provider.update                      Update a record in a content provider
app.service.info                         Get information about exported services
app.service.send                         send a Message to a service, and display the reply
app.service.start                        Start Service
app.service.stop                         Stop Service
auxiliary.webcontentresolver             Start a web service interface to content providers.
exploit.pilfer.general.apnprovider       Reads APN content provider
exploit.pilfer.general.settingsprovider  Reads Settings content provider
information.datetime                     Print Date/Time
information.deviceinfo                   Get verbose device information
information.permissions                  Get a list of all permissions used by packages on the device
scanner.misc.native                      Find native components included in packages
scanner.misc.readablefiles               Find world-readable files in the given folder
scanner.misc.secretcodes                 Search for secret codes that can be used from the dialer
scanner.misc.sflagbinaries               Find suid/sgid binaries in the given folder (default is /system).
scanner.misc.writablefiles               Find world-writable files in the given folder
scanner.provider.finduris                Search for content providers that can be queried from our context.
scanner.provider.injection               Test content providers for SQL injection vulnerabilities.
scanner.provider.sqltables               Find tables accessible through SQL injection vulnerabilities.
scanner.provider.traversal               Test content providers for basic directory traversal vulnerabilities.
shell.exec                               Execute a single Linux command.
shell.send                               Send an ASH shell to a remote listener.
shell.start                              Enter into an interactive Linux shell.
tools.file.download                      Download a File
tools.file.md5sum                        Get md5 Checksum of file
tools.file.size                          Get size of file
tools.file.upload                        Upload a File
tools.setup.busybox                      Install Busybox.
tools.setup.minimalsu                    Prepare 'minimal-su' binary installation on the device.
dz>

사용법은 help module명 하면 볼 수 있고, 실행하려면 run module명 옵션 하면된다.

drozer 메뉴얼
https://labs.mwrinfosecurity.com/system/assets/502/original/mwri_drozer-users-guide_2013-07-25.pdf

drozer demo