• Stars
    star
    111
  • Rank 314,510 (Top 7 %)
  • Language
    Java
  • License
    Other
  • Created almost 12 years ago
  • Updated 9 months ago

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

The Android Agent for the Mercury Security Assessment Framework.

drozer

drozer (formerly Mercury) is the leading security testing framework for Android.

drozer allows you to search for security vulnerabilities in apps and devices by assuming the role of an app and interacting with the Dalvik VM, other apps' IPC endpoints and the underlying OS.

drozer provides tools to help you use, share and understand public Android exploits. It helps you to deploy a drozer Agent to a device through exploitation or social engineering. Using weasel (MWR's advanced exploitation payload) drozer is able to maximise the permissions available to it by installing a full agent, injecting a limited agent into a running process, or connecting a reverse shell to act as a Remote Access Tool (RAT).

drozer is open source software, maintained by MWR InfoSecurity, and can be downloaded from:

mwr.to/drozer

Building Using Android Studio

  1. Open Android Studio and launch the Android SDK manager from it (Tools > Android > SDK Manager)
  2. Check that these two components are installed and updated to the latest version. Install or upgrade them if necessary.
    1. Android SDK Platform Tools
    2. Android Support Library
    3. Google Play Services
    4. Google Repository
    5. Android NDK tools
  3. Return to Android Studio and select Import Project
  4. Select the drozer-agent directory
  5. Select "Import from existing model - Gradle"

IMPORTANT: Once imported make sure the project has been synchronized with the Gradle files.

Build Dependencies

  1. Java 1.7
  2. libprotobuf-java 2.6.1 or higher
  3. protobuf-compiler 2.6 or higher

License

drozer is released under a 3-clause BSD License. See LICENSE for full details.

Contacting the Project

drozer is Open Source software, made great by contributions from the community.

For full source code, to report bugs, suggest features and contribute patches please see our Github project:

https://github.com/mwrlabs/drozer

Bug reports, feature requests, comments and questions can be submitted sent to:

drozer [at] mwrinfosecurity.com

Follow the latest drozer news, follow the project on Twitter:

@mwrdrozer

More Repositories

1

drozer

The Leading Security Assessment Framework for Android.
Python
3,894
star
2

chainsaw

Rapidly Search and Hunt through Windows Forensic Artefacts
Rust
2,713
star
3

C3

Custom Command and Control (C3). A framework for rapid prototyping of custom C2 channels, while still providing integration with existing offensive toolkits.
C++
1,498
star
4

needle

The iOS Security Testing Framework
Python
1,331
star
5

doublepulsar-detection-script

A python2 script for sweeping a network to find windows systems compromised with the DOUBLEPULSAR implant.
Python
1,008
star
6

awspx

A graph-based tool for visualizing effective access and resource relationships in AWS environments.
Python
913
star
7

python-exe-unpacker

A helper script for unpacking and decompiling EXEs compiled from python code.
Python
751
star
8

leonidas

Automated Attack Simulation in the Cloud, complete with detection use cases.
Jupyter Notebook
446
star
9

android-keystore-audit

JavaScript
385
star
10

physmem2profit

Physmem2profit can be used to create a minidump of a target hosts' LSASS process by analysing physical memory remotely
C#
364
star
11

Jandroid

Python
323
star
12

CallStackSpoofer

A PoC implementation for spoofing arbitrary call stacks when making sys calls (e.g. grabbing a handle via NtOpenProcess)
C++
294
star
13

bitlocker-spi-toolkit

Tools for decoding TPM SPI transaction and extracting the BitLocker key from them.
Python
271
star
14

captcha22

CAPTCHA22 is a toolset for building, and training, CAPTCHA cracking models using neural networks.
Python
243
star
15

doublepulsar-c2-traffic-decryptor

A python2 script for processing a PCAP file to decrypt C2 traffic sent to DOUBLEPULSAR implant
Python
224
star
16

snake

snake - a malware storage zoo
Shell
205
star
17

Jamf-Attack-Toolkit

Suite of tools to facilitate attacks against the Jamf macOS management platform.
Python
172
star
18

IAMSpy

Python
169
star
19

damn-vulnerable-llm-agent

Python
169
star
20

LinuxCatScale

Incident Response collection and processing scripts with automated reporting scripts
Shell
165
star
21

IceKube

Python
161
star
22

peas

PEAS is a Python 2 library and command line application for running commands on an ActiveSync server e.g. Microsoft Exchange.
Python
152
star
23

ppid-spoofing

Scripts for performing and detecting parent PID spoofing
PowerShell
127
star
24

detectree

Data visualization for blue teams
Svelte
123
star
25

GarbageMan

GarbageMan is a set of tools for analyzing .NET binaries through heap analysis.
C++
113
star
26

doublepulsar-usermode-injector

A utility to use the usermode shellcode from the DOUBLEPULSAR payload to reflectively load an arbitrary DLL into another process, for use in testing detection techniques or other security research.
C
104
star
27

TickTock

C++
102
star
28

ModuleStomping

https://blog.f-secure.com/hiding-malicious-code-with-module-stomping/
C++
87
star
29

dotnet-gargoyle

A spiritual .NET equivalent to the Gargoyle memory scanning evasion technique
C#
50
star
30

cloud-wiki

A public cloud security knowledgebase - https://www.secwiki.cloud/
CSS
48
star
31

AMSIDetection

AMSI detection PoC
C#
29
star
32

tau-engine

A document tagging library
Rust
29
star
33

radare2-scripts

A collection of useful radare2 scripts!
Python
25
star
34

CVE-2021-25374_Samsung-Account-Access

This script can be used to gain access to a victim's Samsung Account if they have a specific version of Samsung Members installed on their Samsung Device, and if the victim's device is from the US or Korea region.
Python
22
star
35

ESFang

ESF modular ingestion tool for development and research.
Objective-C
18
star
36

macOSTriageCollectionScript

A triage data collection script for macOS
Shell
17
star
37

lazarus-sigma-rules

17
star
38

RemotePSpy

RemotePSpy provides live monitoring of remote PowerShell sessions, which is particularly useful for older (pre-5.0) versions of PowerShell which do not have comprehensive logging facilities built in.
Python
17
star
39

FLAIR

F-Secure Lightweight Acqusition for Incident Response (FLAIR)
Batchfile
16
star
40

mongo-rs

A higher-level wrapper on top of the official bson & mongodb crates.
Rust
15
star
41

llm-vulnerable-recruitment-app

An example vulnerable app that integrates an LLM
Python
12
star
42

volatility-plugins

Python
11
star
43

FixerUpper

A Burp extension to enable modification of FIX messages when relayed from MitM_Relay
Python
11
star
44

snake-core

snake-core - the real snake
Python
11
star
45

jdiesel

jdiesel fuels the drozer
Java
10
star
46

deject

Memory dump and Sample analysis tool
Python
8
star
47

memory-carving-scripts

Scripts for extracting useful information from infected memory dumps
PowerShell
7
star
48

shadowhammer

Tools related to 'shadowhammer' attack, https://securelist.com/operation-shadowhammer/89992
Python
7
star
49

keywe-tooling

Tools that can be used to interact with the KeyWe Smart Lock device.
Python
6
star
50

datamate

Python
6
star
51

usb-ninja-detection-poc

USB Ninja Detection PoC
C++
5
star
52

iocs

YARA
5
star
53

snake-scales

snake-scales - the default repository of snake scales
Python
4
star
54

dreamer

Easier cloud infrastructure with Terraform and Ansible
Python
4
star
55

snake-skin

snake-skin - the web ui for snake
Svelte
2
star
56

boops-boops-android-agent

Java
1
star
57

snake-tail

snake-tail - the command line ui for snake
Python
1
star
58

slide-decks

1
star