Attacking Android Apps

What is Drozer?

Drozer is a framework for assessing Android application security, particularly the interfaces exposed by applications through the Android component system.

It helps a security researcher investigate how an application can be reached and what an external caller can make it do.

Think of an Android app as a building.

Inside the building are several doors:

• A door leading to a login screen.
• A door leading to a password vault.
• A door allowing access to stored data.
• A door leading to a background service.

The developer may intend users to enter through the login screen.

However, Android applications often expose components that other applications can invoke directly.

Drozer helps you discover and investigate those entry points.

How Drozer fits into the Android architecture

The drozer console runs on the testing machine. The drozer Agent runs on Android and helps the console interact with the device's application environment.

The Android framework still enforces applicable security checks. Drozer does not automatically become root or bypass every Android security restriction.

Instead, it provides an interface for investigating what a caller can legitimately access and identifying situations where an application's own controls are inadequate.

Install drozer:

pip install drozer

Running:

adb forward tcp:31415 tcp:31415

drozer console connect

Drozer recon basics

Finding package names for installed apps

Example: List installed apps on the device:

run app.package.list

Output:

dz> run app.package.list
Attempting to run shell module
com.samsung.android.provider.filterprovider (Filter Provider)
com.monotype.android.font.rosemary (RoseEUKor)
appinventor.ai_notbabru.testcompelson (testcompelson)
com.sec.android.app.DataCreate (Automation Test)
com.samsung.android.app.ledcoverdream (LED icon editor)
com.android.cts.priv.ctsshim (com.android.cts.priv.ctsshim)
com.gd.mobicore.pa (RootPA)
com.sec.android.widgetapp.samsungapps (Galaxy Essentials Widget)
com.samsung.android.smartswitchassistant (com.samsung.android.smartswitchassistant)
com.sec.vsim.ericssonnsds.webapp (NSDSWebApp)
com.sec.android.app.setupwizardlegalprovider (SetupWizardLegalProvider)
com.google.android.youtube (YouTube)
com.samsung.android.app.galaxyfinder (Finder)
com.sec.location.nsflp2 (Samsung Location SDK)
com.samsung.android.themestore (Galaxy Themes)
com.sec.android.app.chromecustomizations (com.sec.android.app.chromecustomizations)
com.samsung.android.app.aodservice (Always On Display)
com.samsung.android.app.cocktailbarservice (Edge screen)
com.android.internal.display.cutout.emulation.corner (Corner cutout)
com.google.android.ext.services (Android Services Library)
com.sec.android.app.suwscriptplayer (SuwScriptPlayer)
com.android.internal.display.cutout.emulation.double (Double cutout)
com.android.providers.telephony (Dialer Storage)
com.sec.android.app.parser (DRParser Mode)
com.samsung.svoice.sync (Voice Service)
me.bridgefy.main.staging (Bridgefy)
com.google.android.googlequicksearchbox (Google)
com.samsung.android.calendar (Calendar)

Example 2: Find an app from a string:

run app.package.list -f termux

Output:

dz> run app.package.list -f termux
Attempting to run shell module
com.termux (Termux)

Retrieving info about an app

Command:

run app.package.info -a com.termux

Output:

dz> run app.package.info -a com.termux
Attempting to run shell module
Package: com.termux
  Application Label: Termux
  Process Name: com.termux
  Version: 0.118.3
  Data Directory: /data/user/0/com.termux
  APK Path: /data/app/com.termux-1002-vZ1FYsnCEhKvGVjDQ==/base.apk
  UID: 10347
  GID: [3003]
  Shared Libraries: null
  Shared User ID: com.termux
  Uses Permissions:
  - android.permission.ACCESS_NETWORK_STATE
  - android.permission.INTERNET
  - android.permission.WRITE_EXTERNAL_STORAGE
  - android.permission.MANAGE_EXTERNAL_STORAGE
  - android.permission.WAKE_LOCK
  - android.permission.VIBRATE
  - android.permission.FOREGROUND_SERVICE
  - android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS
  - android.permission.SYSTEM_ALERT_WINDOW
  - android.permission.READ_LOGS
  - android.permission.DUMP
  - android.permission.WRITE_SECURE_SETTINGS
  - android.permission.REQUEST_INSTALL_PACKAGES
  - android.permission.PACKAGE_USAGE_STATS
  - com.android.alarm.permission.SET_ALARM
  - android.permission.READ_EXTERNAL_STORAGE
  Defines Permissions:
  - com.termux.permission.RUN_COMMAND

dz>

Review the attack surface of Termux

Command:

run app.package.attacksurface com.termux

Output:

dz> run app.package.attacksurface com.termux
Attempting to run shell module
Attack Surface:
  4 activities exported
  0 broadcast receivers exported
  2 content providers exported
  1 services exported
    Shared UID (com.termux)
dz>