How to use Drozer for Android security testing

How to Use Drozer for Android Security Testing

Drozer is a security testing framework for Android. It lets you interact with an app's components, such as activities, services and content providers, to find weaknesses. This guide covers the basic setup and commands. Only test apps you own or are authorised to test.

What you need

An Android device or emulator with USB debugging turned on. A rooted device is preferred.
The Drozer agent installed on the device, from the Drozer releases page.
The Drozer console on your computer (Windows or Linux). This guide uses Android Tamer, a virtual machine with mobile testing tools pre-installed, from sourceforge.net/projects/androidtamer, running in VirtualBox.
A deliberately vulnerable app to practise on. This guide uses DIVA (Damn Insecure and Vulnerable App) from github.com/payatu/diva-android.

Connect the device

Start Android Tamer in VirtualBox and connect your device to it. Check the connection by running adb devices; your device should be listed.

Open the Drozer agent on the device and turn on its server.

Basic Drozer commands

In a terminal on the computer:

adb forward tcp:31415 tcp:31415 forwards the port so the console can reach the agent.
drozer console connect opens the Drozer console.
list lists the available Drozer modules.
run app.package.list lists all apps installed on the device.
run app.package.list -f diva searches for an app by name; here, diva.
run app.package.info -a jakhar.aseem.diva shows information about a package; jakhar.aseem.diva is DIVA's package name.
run app.package.attacksurface jakhar.aseem.diva shows the app's attack surface: its exported components.
run app.activity.info -a jakhar.aseem.diva lists the app's activities and whether they are exported.
run app.activity.start --component jakhar.aseem.diva jakhar.aseem.diva.APICredsActivity starts an activity on the device: package name first, then the component name.

Drozer has many more modules for testing content providers, services and broadcast receivers. Use list to explore them.

How Vooki Pro helps

Drozer tests the Android app's components; Vooki Pro tests the web APIs behind the app.
Import API requests as cURL, HAR or Postman and scan them automatically.
Findings come with evidence and remediation your back-end team can act on.

Frequently asked questions

What is Drozer used for?

Testing Android app components, such as exported activities and content providers, for security weaknesses.

Is Drozer still maintained?

Check the project repository for current status and supported Android versions before relying on it.

Try Vooki Pro free for 7 days

Cover your app's back-end APIs with automated testing. The trial unlocks every feature for 7 days, and scanning runs on your own machine.

Get Vooki Pro → · REST API scanning with Vooki Pro

How to Use Drozer for Android Security Testing | Vooki Pro