KEMBAR78
Drozer Command Cheat Sheet: Starting A Session | PDF
Scribd
Upload
1K views1 page

Drozer Command Cheat Sheet: Starting A Session

This document provides a cheat sheet for using Drozer, a security assessment tool for Android applications. It lists common Drozer commands for retrieving package information, identifying an app's attack surface, exploiting activities, content providers, broadcast receivers, and services. The commands allow analyzing app permissions and components, starting activities, querying content providers, and interacting with services.

Uploaded by

Hemanth Yarlagadda
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
1K views1 page

Drozer Command Cheat Sheet: Starting A Session

This document provides a cheat sheet for using Drozer, a security assessment tool for Android applications. It lists common Drozer commands for retrieving package information, identifying an app's attack surface, exploiting activities, content providers, broadcast receivers, and services. The commands allow analyzing app permissions and components, starting activities, querying content providers, and interacting with services.

Uploaded by

Hemanth Yarlagadda
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 1

Drozer Command Cheat Sheet

Starting a session
• adb forward tcp:31415 tcp:31415
• //Start Embedded Server on Agent apk
• Drozer console connect

Retrieving package information


• run app.package.list -f [app name]
• run app.package.info -a [package name]

Identifying the attack surface


• run app.package.attacksurface [package name]

Exploiting activities
• run app.Activity.info -a [package name] -u
• run app.Activity.start --component [package name] [component name]

Exploiting content provider


• run app.provider.info -a [package name]
• run scanner.provider.finduris -a [package name]
• run app.provider.query [uri]
• run app.provider.update [uri] --selection [conditions] [selection arg] [column] [data]
• run scanner.provider.sqltables -a [package name]
• run scanner.provider.Injection -a [package name]
• run scanner.provider.traversal -a [package name]

Exploiting broadcast receivers


• run app.broadcast.info -a [package name]
• run app.broadcast.send --component [package name] [component name] --extra
[type] [key] [value]
• run app.broadcast.sniff --action [action]

Exploiting service
• run app.service.info -a [package name]
• run app.service.start --action [action] --component [package name] [component
name]
• run app.service.send [package name] [component name] --msg [what] [arg1] [arg2] -
-extra [type] [key] [value] --bundle-as-obj

You might also like