描述

Scrounger - 一个借用或依靠他人的人。

这个工具没有比这更好的描述了，原因主要有两个：首先，这个工具借鉴了许多已经发布的其它工具；其次，它依靠移动应用程序的漏洞来运行。

为什么

尽管已经开发了许多其他的移动应用程序分析工具，但没有一个工具可以同时用于Android和iOS，并被称为每个移动应用程序评估中必须使用的“标准”工具。

Scrounger 背后的想法是制造一个类似Metasploit的工具，它不会代替渗透测试人员的工作，而是通过执行所有评估中都需要进行的繁琐任务来帮助渗透测试人员进行评估。

区别

Scrounger 提供其他工具没有的主要功能：

• 同时支持Android和iOS
• 类似Metasploit的控制台和模块
• 提供多种模块，可以运行这些模块为渗透测试人员提供一个起点
• 易于扩展

灵感 / 致谢

Scrounger 的灵感来自其他工具，非常感谢以下工具的开发者：

• Drozer (https://github.com/mwrlabs/drozer);
• Needle (https://github.com/mwrlabs/needle); 以及
• iOS Application Analysis (https://github.com/timb-machine/ios-application-analyser).

技术

作为声明，Scrounger 识别的所有发现都应始终手动复核。

当使用需要Android或iOS设备的模块时，Scrounger 需要分别使用 已Root 或 已越狱 的设备。

Scrounger 已经在 iOS 11 和 Android 8.1 上测试通过。

Scrounger 仅针对 python 2.7 构建。

安装```

git clone https://github.com/nettitude/scrounger.git cd scrounger bash setup.sh pip install -r requirements.txt python setup.py install

## 开发```
git pull https://github.com/nettitude/scrounger.git
cd scrounger
bash setup.sh
pip install -r requirements.txt
python setup.py develop

更新```

cd scrounger git pull python setup.py install --upgrade

## 必要的二进制文件

### 对于 Android 模块
* java (<http://www.oracle.com/technetwork/java/javase/downloads/index.html>)
* jd-cli (<https://github.com/kwart/jd-cmd>)
* apktool (<https://ibotpeaches.github.io/Apktool/>)
* d2j-dex2jar (<https://github.com/pxb1988/dex2jar>)
* adb (<https://developer.android.com/studio/releases/platform-tools>)
* 其他（可选）：
    * avdmanager (<https://developer.android.com/studio/#downloads>)


### 对于 iOS 模块
* jtool（Linux）(<http://www.newosxbook.com/tools/jtool.html>)
* otool（MacOS）(<https://developer.apple.com/xcode/>)
* ldid (<https://github.com/daeken/ldid.git>)
* iproxy（包：libimobiledevice）
* lsusb（包：usbutils）
* unzip

### iOS 二进制文件
* 捆绑的二进制文件：
    * dump_backup_flag
    * dump_file_protection
    * dump_keychain
    * dump_log
    * listapps
* Cydia Karen 的仓库 (https://cydia.angelxwind.net)（可选）：
    * AppSync Unified（包：net.angelxwind.appsyncunified）
    * appinst（包：com.linusyang.appinst）
* Cydia Shmoo419 的仓库 (https://shmoo419.github.io/)（可选）：
    * uncrypt11（包：com.shmoo.uncrypt11）
    * gdb（包：gdb71050）
* Cydia Ichitaso 的仓库 (http://cydia.ichitaso.com/)（可选）：
    * clutch（包：com.kjcracks.clutch2）

## 安装脚本

### Linux```
# install iproxy lsusb
sudo apt-get install libimobiledevice usbutils

# install jd-cli
if [ ! -x "$(which jd-cli)" ]; then
    curl -L -o /tmp/jdcli.zip https://github.com/kwart/jd-cmd/releases/download/jd-cmd-0.9.2.Final/jd-cli-0.9.2-dist.zip
    unzip /tmp/jdcli.zip /usr/local/share/jd-cli
    ln -s /usr/local/share/jd-cli/jd-cli /usr/local/bin/jd-cli
    ln -s /usr/local/share/jd-cli/jd-cli.jar /usr/local/bin/jd-cli.jar
    rm -rf /tmp/jdcli.zip
fi

# install apktool
if [ ! -x "$(which apktool)" ]; then
    mkdir /usr/local/share/apktool
    curl -L -o /usr/local/share/apktool/apktool https://raw.githubusercontent.com/iBotPeaches/Apktool/master/scripts/osx/apktool
    curl -L -o /usr/local/share/apktool/apktool.jar https://bitbucket.org/iBotPeaches/apktool/downloads/apktool_2.3.3.jar
    chmod +x /usr/local/share/apktool /usr/local/share/apktool/apktool.jar
    ln -s /usr/local/share/apktool /usr/local/bin/apktool
    ln -s /usr/local/share/apktool.jar /usr/local/bin/apktool.jar
fi

# install dex2jar
if [ ! -x "$(which d2j-dex2jar)" ]; then
    curl -L -o /tmp/d2j.zip https://github.com/pxb1988/dex2jar/files/1867564/dex-tools-2.1-SNAPSHOT.zip
    unzip /tmp/d2j.zip -d /tmp/d2j
    dirname=$(ls --color=none /tmp/d2j)
    mv /tmp/d2j/$dirname /usr/local/share/d2j-dex2jar
    ln -s /usr/local/share/d2j-dex2jar/d2j-dex2jar.sh /usr/local/bin/d2j-dex2jar.sh
    ln -s /usr/local/share/d2j-dex2jar/d2j-apk-sign.sh /usr/local/bin/d2j-apk-sign.sh
    rm -rf /tmp/d2j.zip
fi

if [ ! -x "$(which d2j-dex2jar)" ]; then
    ln -s /usr/local/bin/d2j-dex2jar.sh /usr/local/bin/d2j-dex2jar
fi

# install adb
if [ ! -x "$(which adb)" ]; then
    curl -L -o /tmp/platform-tools.zip https://dl.google.com/android/repository/platform-tools-latest-linux.zip
    unzip /tmp/platform-tools.zip -d /tmp/pt
    mv /tmp/pt/platform-tools /usr/local/share/
    ln -s /usr/local/share/platform-tools/adb /usr/local/bin/adb
    ln -s /usr/local/share/platform-tools/fastboot /usr/local/bin/fastboot
fi

# install ldid
if [ ! -x "$(which ldid)" ]; then
    git clone https://github.com/daeken/ldid.git /tmp/ldid
    cd /tmp/ldid
    ./make.sh
    mv ldid /usr/local/bin/
    cd /tmp
    rm -rf /tmp/ldid
fi

# install jtool
if [ ! -x "$(which jtool)" ]; then
    curl -L -o /tmp/jtool.tar http://www.newosxbook.com/tools/jtool.tar
    mkdir /tmp/jtool
    tar xvf /tmp/jtool.tar -C /tmp/jtool
    mv /tmp/jtool/jtool.ELF64 /usr/local/bin/jtool
    rm -rf /tmp/jtool.tar /tmp/jtool
fi

# install scrounger
git clone [email protected]:nettitude/scrounger.git
cd scrounger
pip install -r requirements.txt
python setup.py install

MacOS```

install iproxy ldid lsusb

brew tap jlhonora/lsusb && brew install lsusb libimobiledevice ldid

install jd-cli

if [ ! -x "$(which jd-cli)" ]; then curl -L -o /tmp/jdcli.zip https://github.com/kwart/jd-cmd/releases/download/jd-cmd-0.9.2.Final/jd-cli-0.9.2-dist.zip unzip /tmp/jdcli.zip /usr/local/share/jd-cli ln -s /usr/local/share/jd-cli/jd-cli /usr/local/bin/jd-cli ln -s /usr/local/share/jd-cli/jd-cli.jar /usr/local/bin/jd-cli.jar rm -rf /tmp/jdcli.zip fi

install apktool

if [ ! -x "$(which apktool)" ]; then mkdir /usr/local/share/apktool curl -L -o /usr/local/share/apktool/apktool https://raw.githubusercontent.com/iBotPeaches/Apktool/master/scripts/osx/apktool curl -L -o /usr/local/share/apktool/apktool.jar https://bitbucket.org/iBotPeaches/apktool/downloads/apktool_2.3.3.jar chmod +x /usr/local/share/apktool /usr/local/share/apktool/apktool.jar ln -s /usr/local/share/apktool /usr/local/bin/apktool ln -s /usr/local/share/apktool.jar /usr/local/bin/apktool.jar fi

install dex2jar

if [ ! -x "$(which d2j-dex2jar)" ]; then curl -L -o /tmp/d2j.zip https://github.com/pxb1988/dex2jar/files/1867564/dex-tools-2.1-SNAPSHOT.zip unzip /tmp/d2j.zip -d /tmp/d2j dirname=$(ls --color=none /tmp/d2j) mv /tmp/d2j/$dirname /usr/local/share/d2j-dex2jar ln -s /usr/local/share/d2j-dex2jar/d2j-dex2jar.sh /usr/local/bin/d2j-dex2jar.sh ln -s /usr/local/share/d2j-dex2jar/d2j-apk-sign.sh /usr/local/bin/d2j-apk-sign.sh rm -rf /tmp/d2j.zip fi

if [ ! -x "$(which d2j-dex2jar)" ]; then ln -s /usr/local/bin/d2j-dex2jar.sh /usr/local/bin/d2j-dex2jar fi

install adb

if [ ! -x "$(which adb)" ]; then curl -L -o /tmp/platform-tools.zip https://dl.google.com/android/repository/platform-tools-latest-darwin.zip unzip /tmp/platform-tools.zip -d /tmp/pt mv /tmp/pt/platform-tools /usr/local/share/ ln -s /usr/local/share/platform-tools/adb /usr/local/bin/adb ln -s /usr/local/share/platform-tools/fastboot /usr/local/bin/fastboot fi

install Xcode / command line tools

xcode-select --install

install scrounger

git clone [email protected]:nettitude/scrounger.git cd scrounger pip install -r requirements.txt python setup.py install

## 添加自定义模块

安装应用程序时，会创建一个文件夹 `~/.scrounger`。
在 `~/.scrounger` 内部，会有一个名为 `modules/custom` 的文件夹，其结构与默认的 scrounger 模块相同，例如 `analysis/android/module_name`。

要创建新的自定义模块，只需添加一个以你想要的模块名命名的文件，它将在你下次启动 scrounger 时被包含。

### 示例

添加以下模块（`~/.scrounger/modules/custom/misc/test.py`）：```
from scrounger.core.module import BaseModule

class Module(BaseModule):
    meta = {
        "author": "RDC",
        "description": """Just a Test module""",
        "certainty": 100
    }