One of the first things that we would typically do
with drozer, is utilize it to find an
attack surface of the application were looking to attack. So the
very first thing that you can do to your ID you could do. You could
run up that package. List.
With this will do as well list off. Like I said, all of the applications
that are currently installed on the device. And as
you recall, we were using the diva app, which has this
package name associated with it. This package
name is what we're going to be using in Crozer to tell
it what application tax should be skin. So they're
a few different like information-gathering type
of commands that we can run through drozer, to
be able to get a general information about the application that
we're looking to attack.
The first going to be, run up that
package.
Dot info and Who provided -
a fruit argument to me? Give it the name of
the application who wish to scan?
What is it going to do with its going to give you a general overview of
details about the application with that means
it's going to tell you where the data directory is. For instance, somewhere.
The APK path is what you ideas
used with it. What version the application is the
name of it, the process name, you know, anything that's really relevant or
interesting on what permissions that uses for instance, as
well. So use instead of a high-level understanding of
information about the application, it something else like to
give us something similar would be up that package. Manifest.
This when you don't have to provide an argument, you just put in the name
of the application. You don't have to put the - A and this
will give you the whole manifest file of the
application itself. So if you remember, we we decompiled the application.
We could reach this through this manifests, the
inside of the resources to this is the same information is
what we're getting here. The reason
why we want to see this because you can show us information about like you
man-cub from missions, are being used versions of
the of the SEK. It's targeting. And
in general Aiken, tells a lot of very good piece of
information such as intense that may exist activities. That
may exist providers, that
may exist. So we get a whole bunch of information about the providers
and activities and such. So if
you want to take this a little bit further service to
get, I do, I'm more like generalized format
of the more like
a summery summary of the Manifest file to tell us all
the information with the things that we could possibly talk to me application.
So I got to run them.
Let's see us up that package. Attack surface.
Open the name the application.
But this will do as it was skinny application to tell you information
about the attack surface. So it tells us about activities broadcast receivers
content providers in services. And also
tells us that the application is debuggable or not, which of
these are things that we might be able to attack of this
one's got activities and content providers. These are
able to be used for activities, typically
could show his potential Access Control violations. Rest
content providers could potentially show us some instances
where queries might be able to be used to
undo SQL injection and that sort of thing. So this
helps to expose the general attack surface of her
application and helps us gather a bit more information about the
application itself. And then from here, we can take a look at some
of the different types of attacks that we can do inside of dresser.