In this video, we're going to discuss how to set up
an insult. Cruiser Cruiser is an application that
is used for Android pen testing to
be able to help to automated detective on her abilities
that are common for Android applications. It works
by detecting a tux surfaces of the
applications. Typically, three things, like concept providers, exported
activities, a services and broadcast receiver
and then it allows you to find those
and potentially run some automated test to
be able to detect if they're vulnerable to some comment on her abilities for
instant content providers could be vulnerable to SQL injection.
So we can read some SQL injection code through
Crozier, to test them. Whole bunch of the content providers,
that wants to see if any of them are Broad. Ripple. So, this
is a very powerful and useful application. There's a
lot of different ways to use it, which will go over in future videos. However,
for now. I'm just going to demonstrate how to actually
installed Roeser.
I'll just tell you to get set up with it before we
dive into anything more. So, very first
thing that you need is python to installed on your computer. I can
use version 2.7 Point 18 just cuz
it's the newest version at the point of making this video. I'm you
can use whatever version to you really want for this that
being a newer version of Virgin to
that comes with Pip packaged in it. I think it started as
of two point seven point nine, but really just pick the newest version
and you should have Pip installed with it. So we're
going to run this and I'll install it for all users. I'll put
in the typical python 2/7. Rectory is installed.
You should see it here with the little hard drive icon next to
it. So you want to make sure that the app is actually present
there.
Imma, go ahead and next and let it install python
to for us. The reason we want hip install
this because there are few dependencies that drugs are actually relies
on so we want to make sure that those dependencies are present just
to ensure that nothing is broken
when we try to actually run Frozen. So the
general concept of drawers or is that it's going to be able to create a
link between our device in our computer, to
be somewhere to the EDB. Like that will allow us to run
some like automated testing and come in through that link and
all the scripture written in Python. They're all open source
and get Hub. So you can see all the scripts, you can contribute to
them and you can utilize them as you please. So you
can see here. We finish the install for python. So
what did I do now? It's going to going to come in line
and I got to type in hip.
You should see something like this if paper was installed
properly and where to go to install some of
the so the prerequisites for drugs or so will say I'm pimp installed
were installed protobuf.
To let this run through. We're also
going to go ahead and install pipe open
SSL.
Is another important one that allows us to make the connection between
the devices and we'll see pip install twisted.
And I think just one other dependency will be able to see that when we
actually are installing one run drozer for the first time.
But these are the three that are mostly
required for a fresh install python. There
may be one or two more depending on your python installation.
So will check those out. Once these finish El,
Sol in general drozer, can be
installed from like the, the labs f-secure page. This is
the general web page for a droser. If you're
looking for this webpage, I guess I'll put more blanks into
a resources section for this course, that you're able to
access these links and be able to get to the content that you eat
up. But yeah, it's a general location of where this is located.
If you Google search, Ford Rosary will be probably the first
or second result. Sometimes forget how page comes up first. You
can also go there to get the installer star that
I use, is the MSI, the easiest one for Windows.
There's of course, Linux and Mac in Star Wars as well,
just in case you're using one of those
Well, I was to install it for all users and you
have to be a bit careful with this. If you
have multiple versions of python, it might default to python3 which
you don't want to install too. As far as I understand.
The dresser isn't really compatible with Python 3. So you
want to see the python to from another location. So we
can click here and say will be installed on
the local hard drive and navigate to
wear python is so it's typically undersea python to
7.
So we'll put in this exact spot here.
And I once we've done this, we can go ahead and click next and that
it will install the the components into
the python to directory. The reason I want the components
in the python to directory is because our past variable is
set to run anything from the directory. For this one
stall to send me that, we can run it through a command line, and
it has easy access to the proper python installation. So
once that's done, it will be able to click finish if
you want to test if it's working or not.
You can just type in drozer. That console connect.
I will season will try to connect the device. It'll pop up
and eat your messages that may exist. So for
instance, you can see that we get this error. No module named
service identity. Just tells us that
we need to install service identity, which you can do by saying
pip install service underscore identity.
Yes, it will work for a little bit and then it
will install that for us and then we'll we should have everything that we
need installed for drozer.
So now that everything's installed for drugs or we can try running this
again. We should just see an issue saying there's no device to connect
to and that will allow us to move on to our next step, which
is just to set up our device with drozer.
This looks perfect. This is exactly what we want to see when this
happens. We just want to be able to install drozer on
our device. So I'm going to go into Google Chrome here
and I'll just accept through these and get a
straight to the default page and we'll just go ahead and type
in freezer.
So once you type that in, you should see this to get her
page here. And then there's the f-secure labs page will go
to the f-secure labs, then to scroll all
the way to the bottom here, and we should see the different
installer. So you can see, there's a PR p.m. New bun to
Archive. There's the MSI that I was using to
install it. And then there's the APK download install
files, which will allow, we will
download it to the downloads folder. So this is okay. And I
can cook. Okay, here to try to open it.
Right, and then it's going to ask me. If I want to allow for unknown apps,
to be installed, will go into the settings. And we'll go ahead and talk of
this to allow apps from this Source. What is
it that I can press on the back arrow and I'll be able to install the
dresser agent.
Silicon install run to the installer. And then I'll be able to
open up the application is installed on
this device. So, with this, we can
turn on the embedded server in. This is what allows it to be able to connect
between the computer and trouser. It's running
on Port 31415. You can see that
on the bottom here. So we need to do, is give me to forward a
TCP connection between her computer and the device on court,
3 1, 4 1 5 2 to do this. We just
go ATB forward, T, CPT code
13145 and we do the same thing again.
Running. This command will create that tunnel between the
two devices.
What does it done? You'll get a 3 1415 in response to
verify that everything worked? And then once we do
this, we can take bin rozar. Back console connect
and we will see if they will actually contact
or device and be working as we
want it to.
May take a few minutes depending on how fast your
internet connection is and you should see something that looks like
this.
And if you want to touch that, it's working. You can run
a few different commands.
So we can save run after a
package. List. What this with
you is it will list all of the applications that are on
the device. So if this command works for you, then
you now have drozer set up and installed correctly. And now
in the next few videos will take a look at some of
the things that we can do it throws her to be able to, you know,
analyze applications, and determine if they're
vulnerable, are not using the tools that are available to us in here.