drozer
Security assessment framework for Android that interacts with the runtime, IPC endpoints, and OS as an installed app to find exposed components.
Technical Architecture & Overview
Drozer is an open-source security assessment framework for Android. It lets an operator act as an installed application and interact with the Android Runtime, other applications' IPC endpoints, and the underlying OS. It is maintained by Reversec.
Targeted Technical Use Cases
Identify and validate Android-specific vulnerabilities, such as exposed content providers, insecure IPC, and misconfigured permissions, by interacting with the device as an installed app.
Evaluation & Trade-offs
Core Strengths
- +Automates common Android application and device attack surface enumeration.
- +Provides a modular plugin architecture for custom tests and public exploit modules.
- +Supports both emulated and physical Android devices.
Trade-Offs & Limitations
- -Limited to Android; does not assess iOS or other mobile platforms.
- -The rewritten Python 3 version is a beta release in which building custom agents crashes the drozer client.
Defensive Security Application
Verify that Android apps do not expose unprotected content providers, activities, services, or broadcast receivers, and remediate IPC misconfigurations before release.
Frequently Asked Questions
What is drozer?→
Drozer is an open-source security assessment framework for Android. It lets an operator act as an installed application and interact with the Android Runtime, other applications' IPC endpoints, and the underlying OS. It is maintained by Reversec.
What is drozer used for?→
Identify and validate Android-specific vulnerabilities, such as exposed content providers, insecure IPC, and misconfigured permissions, by interacting with the device as an installed app.
What are the strengths of drozer?→
- +Automates common Android application and device attack surface enumeration.
- +Provides a modular plugin architecture for custom tests and public exploit modules.
- +Supports both emulated and physical Android devices.
What are the limitations of drozer?→
- +Limited to Android; does not assess iOS or other mobile platforms.
- +The rewritten Python 3 version is a beta release in which building custom agents crashes the drozer client.
How is drozer used defensively?→
Verify that Android apps do not expose unprotected content providers, activities, services, or broadcast receivers, and remediate IPC misconfigurations before release.