> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/android-appsec/dynamic-analysis/tools/drozer.md).

# Drozer

Drozer allows you to search for security vulnerabilities in Android apps and devices by:

* Assuming the role of an app and interacting with the Android Runtime, other apps' IPC endpoints, and the underlying OS.
* Providing tools to help use, share, and understand public Android exploits.

#### Drozer Components

1. **Drozer Client**: The PC component used to issue commands to the agent.
2. **Drozer Agent**: The Android application for the testing device.

***

#### Installation Steps

**Drozer Installation (Kali/Debian)**

1. Download the appropriate `drozer-<version>.whl` file from the [Drozer GitHub Releases](https://github.com/WithSecureLabs/drozer/releases/).

   ```bash
   pip install drozer-<version>.whl
   ```
2. Download the Drozer Agent APK file from the [Drozer Agent GitHub Releases](https://github.com/WithSecureLabs/drozer-agent/releases/).

**Connect Drozer with ADB**

1. Open the Drozer app on the emulator and click the **OFF** button to start the embedded server.
   * The server listens on port `31415` by default.
2. Forward Drozer client commands to the server using ADB:

   ```bash
   adb forward tcp:31415 tcp:31415
   ```
3. Connect to the Drozer console:

   ```bash
   drozer console connect
   ```

***

#### Drozer Console Commands

| **Command**    | **Description**                                                              |
| -------------- | ---------------------------------------------------------------------------- |
| `list`         | Show all available Drozer modules for the current session.                   |
| `shell`        | Start an interactive Linux shell on the device, within the Agent process.    |
| `cd`           | Change the root namespace for the session to avoid typing full module names. |
| `clean`        | Remove temporary files stored by Drozer on the Android device.               |
| `contributors` | Display contributors to the Drozer framework and modules.                    |
| `echo`         | Print text to the console.                                                   |
| `exit`         | Terminate the Drozer session.                                                |
| `help`         | Display help about a specific command or module.                             |
| `load`         | Load and execute commands from a file.                                       |
| `module`       | Find and install additional Drozer modules from the Internet.                |
| `permissions`  | Display permissions granted to the Drozer agent.                             |
| `set`          | Store a value as an environment variable for Linux shells spawned by Drozer. |
| `unset`        | Remove a variable set for Linux shells spawned by Drozer.                    |

***

#### Drozer Module Examples

* **Show all installed packages:**

  ```bash
  dz> run app.package.list
  ```
* **Get package information:**

  ```bash
  dz> run app.package.info -a <package-name>
  ```
* **Identify the attack surface of a package:**

  ```bash
  dz> run app.package.attacksurface <package-name>
  ```