Skip to content

Droz_scan is a automated script, that runs all the queries of drozer in a single run

Notifications You must be signed in to change notification settings

themalwarenews/drozscan

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

9 Commits
 
 
 
 

Repository files navigation

Drozscan

Nothing unique, just an automation


image

Drozscan is just an automated script to run all drozer commands in a single run. See the results in CLI, JSON or HTML.


NOTE : Make sure you installed and configured the drozer tool before running the script.


PRESEQUITES

  1. Linux/OSX machine
  2. Genymotion/Android emulator/Rooted device

QUERIES EXECUTED BY TOOL.

  1. Get Package complete Info
  2. Get activities information
  3. Get broadcast receivers information
  4. Get attack surface details
  5. Get package with backup API details
  6. Get Android Manifest of the package
  7. Get native libraries information
  8. Get content provider information
  9. Get URIs from package
  10. Get services information
  11. Get native components included in package
  12. Get world readable files in app installation directory /data/data/<package_name>/
  13. Get world writeable files in app installation directory /data/data/<package_name>/
  14. Get content providers that can be queried from current context
  15. Perform SQL Injection on content providers
  16. Find SQL Tables trying SQL Injection
  17. Test for directory traversal vulnerability

How to use

  1. Make sure you have connected the android virtual device to your attacking machine.
  2. Check whether Port forwarding is done for drozer client.
  3. Download or Clone the drozscan Repo.
  4. From the terminal, move into Garuda Directory
  5. Run python scanme.py

Bad UI in html page, will be working on them, however tool does its job

Inspired by interference-security

Thank YOU

Releases

No releases published

Packages

No packages published

Languages