渗透测试之移动端 安卓

渗透测试之移动端，对于安卓，一般使用如下方法进行安全分析，如下表所示：

# Adb
# https://developer.android.com/studio/command-line/adb?hl=es-419
adb connect IP:PORT/ID
adb devices
adb shell
adb push
adb install

# Analyze URLs in apk:
# https://github.com/shivsahni/APKEnum
python APKEnum.py -p ~/Downloads/app-debug.apk

# AndroPyTool:
# https://github.com/alexMyG/AndroPyTool
docker pull alexmyg/andropytool
docker run --volume=:/apks alexmyg/andropytool -s /apks/ -all

# Android Backup files (*.ab files)
( printf "\x1f\x8b\x08\x00\x00\x00\x00\x00" ; tail -c +25 backup.ab ) |  tar xfvz -

# Frida
# Load Frida Server in device && run objeciton
adb root
adb push /root/Downloads/frida-server-12.7.24-android-arm /data/local/tmp/.
adb root
adb shell "chmod 755 /data/local/tmp/frida-server && /data/local/tmp/frida-server &"
frida -U -f com.vendor.app.version -l PATH\fridaGlomoPR.js --no-pause

ob