{"id":13716099,"url":"https://github.com/saeidshirazi/awesome-android-security","last_synced_at":"2026-01-05T18:05:10.087Z","repository":{"id":37594106,"uuid":"296523529","full_name":"saeidshirazi/awesome-android-security","owner":"saeidshirazi","description":"A curated list of Android Security materials and resources For Pentesters and Bug Hunters","archived":false,"fork":false,"pushed_at":"2024-05-03T15:27:16.000Z","size":174,"stargazers_count":1572,"open_issues_count":2,"forks_count":240,"subscribers_count":70,"default_branch":"master","last_synced_at":"2024-05-23T04:06:26.836Z","etag":null,"topics":["android-awesome","android-cookbook","android-malware","android-pentest","android-pentesting","android-security"],"latest_commit_sha":null,"homepage":"","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/saeidshirazi.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-09-18T05:33:44.000Z","updated_at":"2024-05-18T17:16:58.000Z","dependencies_parsed_at":"2024-05-11T23:00:23.003Z","dependency_job_id":"29f83ea0-da6d-4f5d-a18f-9e1e77df9ad2","html_url":"https://github.com/saeidshirazi/awesome-android-security","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/saeidshirazi%2Fawesome-android-security","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/saeidshirazi%2Fawesome-android-security/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/saeidshirazi%2Fawesome-android-security/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/saeidshirazi%2Fawesome-android-security/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/saeidshirazi","download_url":"https://codeload.github.com/saeidshirazi/awesome-android-security/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":245579677,"owners_count":20638679,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["android-awesome","android-cookbook","android-malware","android-pentest","android-pentesting","android-security"],"created_at":"2024-08-03T00:01:07.043Z","updated_at":"2026-01-05T18:05:10.080Z","avatar_url":"https://github.com/saeidshirazi.png","language":null,"funding_links":[],"categories":["Others","Others (1002)","System","Security \u0026 Hacking","Awesome Sites"],"sub_categories":[],"readme":"# Awesome-Android-Security ![awesome](https://awesome.re/badge.svg)\n![Screenshot](img/androidsec.png)\n\n \n\n\n# Table of Contents\n- [Blog](#blog)\n- [How To's](#how-tos)\n- [Papers](#paper)\n- [Books](#books)\n- [Trainings](#Trainings)\n- [Tools](#tools)\n  * [Static Analysis Tools](#Static-Analysis)\n  * [Dynamic Analysis Tools](#Dynamic-Analysis)\n  * [Online APK Analyzers](#Online-APK-Analyzers)\n  * [Online APK Decompiler](#Online-APK-Decompiler)\n  * [Forensic Analysis Tools](#Forensic-Analysis)\n- [Labs](#labs)\n- [Talks](#talks)\n- [Misc](#misc)\n- [Bug Bounty \u0026 Writeups](#Bug-Bounty-\u0026-Writeup)\n- [Cheat Sheet](#Cheat-Sheet)\n- [Checklist](#Checklist)\n- [Bug Bounty Report](#Bug-Bounty-Report)\n\n# Blogs\n\n* [1-click Exploit in South Korea's biggest mobile chat app](https://stulle123.github.io/posts/kakaotalk-account-takeover/)\n* [20 Security Issues Found in Xiaomi Devices](https://blog.oversecured.com/20-Security-Issues-Found-in-Xiaomi-Devices/)\n* [Bypass Instagram and Threads SSL pinning on Android](https://github.com/Eltion/Instagram-SSL-Pinning-Bypass)\n* [Reverse Engineering Android game Coin Hunt World and its communication protocol to cheat the app](https://research.nccgroup.com/2023/05/31/reverse-engineering-coin-hunt-worlds-binary-protocol/)\n* [Discovering vendor-specific vulnerabilities in Android](https://blog.oversecured.com/Discovering-vendor-specific-vulnerabilities-in-Android/)\n* [Technical analysis of Alien android malware](https://muha2xmad.github.io/malware-analysis/alien/)\n* [Lock Screen Bypass Exploit of Android Devices (CVE-2022–20006)](https://medium.com/maverislabs/lock-screen-bypass-exploit-of-android-devices-cve-2022-20006-604958fcee3a)\n* [Analysis of Android banking Trojan MaliBot that is based on S.O.V.A banker](https://www.f5.com/labs/articles/threat-intelligence/f5-labs-investigates-malibot)\n* [Pending Intents: A Pentester’s view](https://valsamaras.medium.com/pending-intents-a-pentesters-view-92f305960f03)\n* [Android security checklist: theft of arbitrary files](https://blog.oversecured.com/Android-security-checklist-theft-of-arbitrary-files/)\n* [Protecting Android users from 0-Day attacks](https://blog.google/threat-analysis-group/protecting-android-users-from-0-day-attacks/)\n* [Reversing an Android sample which uses Flutter](https://cryptax.medium.com/reversing-an-android-sample-which-uses-flutter-23c3ff04b847)\n* [Step-by-step guide to reverse an APK protected with DexGuard using Jadx](https://blog.lexfo.fr/dexguard.html)\n* [Use cryptography in mobile apps the right way](https://blog.oversecured.com/Use-cryptography-in-mobile-apps-the-right-way/)\n* [Android security checklist: WebView](https://blog.oversecured.com/Android-security-checklist-webview/)\n* [Common mistakes when using permissions in Android](https://blog.oversecured.com/Common-mistakes-when-using-permissions-in-Android/)\n* [Two weeks of securing Samsung devices: Part 2](https://blog.oversecured.com/Two-weeks-of-securing-Samsung-devices-Part-2/)\n* [Why dynamic code loading could be dangerous for your apps: a Google example](https://blog.oversecured.com/Why-dynamic-code-loading-could-be-dangerous-for-your-apps-a-Google-example/)\n* [Two weeks of securing Samsung devices: Part 1](https://blog.oversecured.com/Two-weeks-of-securing-Samsung-devices-Part-1/)\n* [How to exploit insecure WebResourceResponse configurations + an example of the vulnerability in Amazon apps](https://blog.oversecured.com/Android-Exploring-vulnerabilities-in-WebResourceResponse)\n* [Exploiting memory corruption vulnerabilities on Android + an example of such vulnerability in PayPal apps](https://blog.oversecured.com/Exploiting-memory-corruption-vulnerabilities-on-Android/)\n* [Capture all android network traffic](https://www.exandroid.dev/2021/03/21/capture-all-android-network-traffic/)\n* [Reverse Engineering Clubhouse](https://www.klmlabs.co/blog/club-house-observations-th5x8)\n* [Escape the Chromium sandbox on Android Devices](https://microsoftedge.github.io/edgevr/posts/yet-another-uaf/)\n* [Android Penetration Testing: Frida](https://www.hackingarticles.in/android-penetration-testing-frida/)\n* [Android: Gaining access to arbitrary* Content Providers](https://blog.oversecured.com/Gaining-access-to-arbitrary-Content-Providers/)\n* [Getting root on a 4G LTE mobile hotspot](https://alex.studer.dev/2021/01/04/mw41-1)\n* [Exploiting new-era of Request forgery on mobile applications](http://dphoeniixx.com/2020/12/13-2/)\n* [Deep Dive into an Obfuscation-as-a-Service for Android Malware](https://wwwstratosphereips.org/blog/2020/12/03/deep-dive-into-an-obfuscation-as-a-service-for-android-malware)\n* [Evernote: Universal-XSS, theft of all cookies from all sites, and more](https://blog.oversecured.com/Evernote-Universal-XSS-theft-of-all-cookies-from-all-sites-and-more/)\n* [Interception of Android implicit intents](https://blog.oversecured.com/Interception-of-Android-implicit-intents/)\n* [AAPG - Android application penetration testing guide](https://nightowl131.github.io/AAPG/)\n* [TikTok: three persistent arbitrary code executions and one theft of arbitrary files](https://blog.oversecured.com/Oversecured-detects-dangerous-vulnerabilities-in-the-TikTok-Android-app/)\n* [Persistent arbitrary code execution in Android's Google Play Core Library: details, explanation and the PoC - CVE-2020-8913](https://blog.oversecured.com/Oversecured-automatically-discovers-persistent-code-execution-in-the-Google-Play-Core-Library/)\n* [Android: Access to app protected components](https://blog.oversecured.com/Android-Access-to-app-protected-components/)\n* [Android: arbitrary code execution via third-party package contexts](https://blog.oversecured.com/Android-arbitrary-code-execution-via-third-party-package-contexts/)\n* [Android Pentesting Labs - Step by Step guide for beginners](https://medium.com/bugbountywriteup/android-pentesting-lab-4a6fe1a1d2e0)\n* [An Android Hacking Primer](https://medium.com/swlh/an-android-hacking-primer-3390fef4e6a0)\n* [An Android Security tips](https://developer.android.com/training/articles/security-tips)\n* [OWASP Mobile Security Testing Guide](https://www.owasp.org/index.php/OWASP_Mobile_Security_Testing_Guide)\n* [Security Testing for Android Cross Platform Application](https://3xpl01tc0d3r.blogspot.com/2019/09/security-testing-for-android-app-part1.html)\n* [Dive deep into Android Application Security](https://blog.0daylabs.com/2019/09/18/deep-dive-into-Android-security/)\n* [Pentesting Android Apps Using Frida](https://www.notsosecure.com/pentesting-android-apps-using-frida/)\n* [Mobile Security Testing Guide](https://mobile-security.gitbook.io/mobile-security-testing-guide/)\n* [Android Applications Reversing 101](https://www.evilsocket.net/2017/04/27/Android-Applications-Reversing-101/#.WQND0G3TTOM.reddit)\n* [Android Security Guidelines](https://developer.box.com/en/guides/security/)\n* [Android WebView Vulnerabilities](https://pentestlab.blog/2017/02/12/android-webview-vulnerabilities/)\n* [OWASP Mobile Top 10](https://www.owasp.org/index.php/OWASP_Mobile_Top_10)\n* [Practical Android Phone Forensics](https://resources.infosecinstitute.com/practical-android-phone-forensics/)\n* [Mobile Pentesting With Frida](https://drive.google.com/file/d/1JccmMLi6YTnyRrp_rk6vzKrUX3oXK_Yw/view)\n* [Zero to Hero - Mobile Application Testing - Android Platform](https://nileshsapariya.blogspot.com/2016/11/zero-to-hero-mobile-application-testing.html)\n* [Detecting Dynamic Loading in Android Applications](https://sayfer.io/blog/dynamic-loading-in-android-applications-with-proc-maps/)\n* [Static Analysis for Android and iOS](https://pentestwiki.org/static-analysis-for-android-and-ios)\n* [Dynamic Analysis for Android and iOS](https://pentestwiki.org/dynamic-analysis-for-android-and-ios)\n* [Exploring intent-based Android security vulnerabilities on Google Play (part 1/3)](https://snyk.io/blog/exploring-android-intent-based-security-vulnerabilities-google-play/)\n* [Hunting intent-based Android security vulnerabilities with Snyk Code (part 2/3)](https://snyk.io/blog/hunting-intent-based-android-security-vulnerabilities-with-snyk-code/)\n* [Mitigating and remediating intent-based Android security vulnerabilities (part 3/3)](https://snyk.io/blog/mitigating-remediating-intent-based-android-security-vulnerabilities/)\n* [Strengthening Android Security: Mitigating Banking Trojan Threats](https://debugactiveprocess.medium.com/strengthening-android-security-mitigating-banking-trojan-threats-fe94ae9e2f02)\n\n# How To's\n\n* [How to analyze mobile malware: a Cabassous/FluBot Case study](https://blog.nviso.eu/2021/04/19/how-to-analyze-mobile-malware-a-cabassous-flubot-case-study/)\n* [How to Bypasses Iframe Sandboxing](https://blog.confiant.com/malvertiser-scamclub-bypasses-iframe-sandboxing-with-postmessage-shenanigans-cve-2021-1801-1c998378bfba)\n* [How To Configuring Burp Suite With Android Nougat](https://blog.ropnop.com/configuring-burp-suite-with-android-nougat/)\n* [How To Bypassing Xamarin Certificate Pinning](https://www.gosecure.net/blog/2020/04/06/bypassing-xamarin-certificate-pinning-on-android/)\n* [How To Bypassing Android Anti-Emulation](https://www.juanurs.com/Bypassing-Android-Anti-Emulation-Part-I/)\n* [How To Secure an Android Device](https://source.android.com/security)\n* [Android Root Detection Bypass Using Objection and Frida Scripts](https://medium.com/@GowthamR1/android-root-detection-bypass-using-objection-and-frida-scripts-d681d30659a7)\n* [Root Detection Bypass By Manual Code Manipulation.](https://medium.com/@sarang6489/root-detection-bypass-by-manual-code-manipulation-5478858f4ad1)\n* [Magisk Systemless Root - Detection and Remediation](https://www.mobileiron.com/en/blog/magisk-android-rooting)\n* [How to use FRIDA to bruteforce Secure Startup with FDE-encryption on a Samsung G935F running Android 8](https://github.com/Magpol/fridafde)\n\n# Papers\n\n\n* [A systematic analysis of commercial Android packers](https://dl.acm.org/doi/abs/10.1145/3540250.3558969)\n* [A Large-Scale Study on the Adoption of Anti-Debugging and Anti-Tampering Protections in Android Apps](https://stefanoberlato.it/publications/pdf/JISA20.pdf)\n* [Things You May Not Know About Android (Un)Packers](https://homes.luddy.indiana.edu/xw7/papers/duan2018ndss.pdf)\n* [Happer: Unpacking Android Apps via a Hardware-Assisted Approach](https://ieeexplore.ieee.org/document/9519458)\n* [AndrODet: An adaptive Android obfuscation detector](https://arxiv.org/pdf/1910.06192.pdf)\n* [GEOST BOTNET - the discovery story of a new Android banking trojan](http://public.avast.com/research/VB2019-Garcia-etal.pdf)\n* [Dual-Level Android Malware Detection](https://www.mdpi.com/2073-8994/12/7/1128)\n* [An Investigation of the Android Kernel Patch Ecosystem](https://www.usenix.org/conference/usenixsecurity21/presentation/zhang)\n   \n# Books\n\n * [SEI CERT Android Secure Coding Standard](https://www.securecoding.cert.org/confluence/display/android/Android+Secure+Coding+Standard)\n * [Android Security Internals](https://www.oreilly.com/library/view/android-security-internals/9781457185496/)\n * [Android Cookbook](https://androidcookbook.com/)\n * [Android Hacker's Handbook](https://www.amazon.com/Android-Hackers-Handbook-Joshua-Drake/dp/111860864X)\n * [Android Security Cookbook](https://www.packtpub.com/in/application-development/android-security-cookbook)\n * [The Mobile Application Hacker's Handbook](https://www.amazon.in/Mobile-Application-Hackers-Handbook-ebook/dp/B00TSA6KLG)\n * [Android Malware and Analysis](https://www.oreilly.com/library/view/android-malware-and/9781482252200/)\n * [Android Security: Attacks and Defenses](https://www.crcpress.com/Android-Security-Attacks-and-Defenses/Misra-Dubey/p/book/9780367380182)\n * [Learning Penetration Testing For Android Devices](https://www.amazon.com/Learning-Penetration-Testing-Android-Devices-ebook/dp/B077L7SNG8)\n* [Android Hacking 2020 Edition](https://www.amazon.com/Hacking-Android-TERRY-D-CLARK-ebook/dp/B08MD2D1SJ)\n\n \n# Trainings\n\n* [SEC575: Mobile Device Security and Ethical Hacking](https://www.sans.org/cyber-security-courses/mobile-device-security-ethical-hacking/)\n* [Android Reverse Engineering_pt-BR](https://www.youtube.com/watch?v=eHdDS2e_qf0\u0026list=PL4zZ9lJ-RCbfv6f6Jc8cJ4ljKqENkTfi7) \n* [Learning-Android-Security](https://www.lynda.com/Android-tutorials/Learning-Android-Security/689762-2.html)\n* [Advanced Android Development](https://developer.android.com/courses/advanced-training/overview)\n* [Learn the art of mobile app development](https://www.edx.org/professional-certificate/harvardx-computer-science-and-mobile-apps)\n* [Learning Android Malware Analysis](https://www.linkedin.com/learning/learning-android-malware-analysis)\n* [Android App Reverse Engineering 101](https://maddiestone.github.io/AndroidAppRE/)\n* [MASPT V2](https://www.elearnsecurity.com/course/mobile_application_security_and_penetration_testing/)\n* [Android Pentration Testing(Persian)](https://www.youtube.com/watch?v=XqS_bA6XfNU\u0026list=PLvVo-xqnJCI7rftDaiEtWFLXlkxN-1Nxn)\n  \n# Tools\n     \n#### Static Analysis\n\n* [BlackDex is an Android unpack(dexdump) tool](https://github.com/CodingGay/BlackDex)\n* [Deoptfuscator - Deobfuscator for Android Application](https://github.com/Gyoonus/deoptfuscator)\n* [Android Reverse Engineering WorkBench for VS Code](https://github.com/Surendrajat/APKLab)\n* [Apktool:A tool for reverse engineering Android apk files](https://ibotpeaches.github.io/Apktool/)\n* [Defeat Java packers via Frida instrumentation](https://github.com/enovella/fridroid-unpacker)\n* [quark-engine - An Obfuscation-Neglect Android Malware Scoring System](https://github.com/quark-engine/quark-engine)\n* [DeGuard:Statistical Deobfuscation for Android](http://apk-deguard.com/)\n* [jadx - Dex to Java decompiler](https://github.com/skylot/jadx/releases)\n* [Amandroid – A Static Analysis Framework](http://pag.arguslab.org/argus-saf)\n* [Androwarn – Yet Another Static Code Analyzer](https://github.com/maaaaz/androwarn/)\n* [Droid Hunter – Android application vulnerability analysis and Android pentest tool](https://github.com/hahwul/droid-hunter)\n* [Error Prone – Static Analysis Tool](https://github.com/google/error-prone)\n* [Findbugs – Find Bugs in Java Programs](http://findbugs.sourceforge.net/downloads.html)\n* [Find Security Bugs – A SpotBugs plugin for security audits of Java web applications.](https://github.com/find-sec-bugs/find-sec-bugs/)\n* [Flow Droid – Static Data Flow Tracker](https://github.com/secure-software-engineering/FlowDroid)\n* [Smali/Baksmali – Assembler/Disassembler for the dex format](https://github.com/JesusFreke/smali)\n* [Smali-CFGs – Smali Control Flow Graph’s](https://github.com/EugenioDelfa/Smali-CFGs)\n* [SPARTA – Static Program Analysis for Reliable Trusted Apps](https://www.cs.washington.edu/sparta)\n* [Gradle Static Analysis Plugin](https://github.com/novoda/gradle-static-analysis-plugin)\n* [Checkstyle – A tool for checking Java source code](https://github.com/checkstyle/checkstyle)\n* [PMD – An extensible multilanguage static code analyzer](https://github.com/pmd/pmd)\n* [Soot – A Java Optimization Framework](https://github.com/Sable/soot)\n* [Android Quality Starter](https://github.com/pwittchen/android-quality-starter)\n* [QARK – Quick Android Review Kit](https://github.com/linkedin/qark)\n* [Infer – A Static Analysis tool for Java, C, C++ and Objective-C](https://github.com/facebook/infer)\n* [Android Check – Static Code analysis plugin for Android Project](https://github.com/noveogroup/android-check)\n* [FindBugs-IDEA Static byte code analysis to look for bugs in Java code](https://plugins.jetbrains.com/plugin/3847-findbugs-idea)\n* [APK Leaks – Scanning APK file for URIs, endpoints \u0026 secrets](https://github.com/dwisiswant0/apkleaks)\n* [Trueseeing – fast, accurate and resillient vulnerabilities scanner for Android apps](https://github.com/monolithworks/trueseeing)\n* [StaCoAn – crossplatform tool which aids developers, bugbounty hunters and ethical hackers](https://github.com/vincentcox/StaCoAn)\n* [APKScanner](https://github.com/n3k00n3/APKScanner)\n* [Mobile Audit – Web application for performing Static Analysis and detecting malware in Android APKs](https://github.com/mpast/mobileAudit)\n* [mariana-trench - Our security focused static analysis tool for Android and Java applications.](https://github.com/facebook/mariana-trench)\n* [semgrep-rules-android-security](https://github.com/mindedsecurity/semgrep-rules-android-security)\n      \n#### Dynamic Analysis\n\n* [Mobile-Security-Framework MobSF](https://github.com/MobSF/Mobile-Security-Framework-MobSF)\n* [Magisk v23.0 - Root \u0026 Universal Systemless Interface](https://github.com/topjohnwu/Magisk)\n* [Runtime Mobile Security (RMS) - is a powerful web interface that helps you to manipulate Android and iOS Apps at Runtime](https://github.com/m0bilesecurity/RMS-Runtime-Mobile-Security)\n* [House: A runtime mobile application analysis toolkit with a Web GUI](https://github.com/nccgroup/house)\n* [Objection - Runtime Mobile Exploration toolkit, powered by Frida](https://github.com/sensepost/objection)\n* [Droid-FF - Android File Fuzzing Framework](https://github.com/antojoseph/droid-ff)\n* [Drozer](https://github.com/FSecureLABS/drozer)\n* [Slicer-automate APK Recon](https://github.com/mzfr/slicer)\n* [Inspeckage](https://github.com/ac-pm/Inspeckage)\n* [PATDroid - Collection of tools and data structures for analyzing Android applications](https://github.com/mingyuan-xia/PATDroid)\n* [Radare2 - Unix-like reverse engineering framework and commandline tools](https://github.com/radareorg/radare2)\n* [Cutter - Free and Open Source RE Platform powered by radare2](https://cutter.re/)\n* [ByteCodeViewer - Android APK Reverse Engineering Suite (Decompiler, Editor, Debugger)](https://bytecodeviewer.com/)\n\n\n        \n#### Online APK Analyzers\n\n* [Guardsquare AppSweep](https://www.guardsquare.com/appsweep-mobile-application-security-testing)\n* [Oversecured](https://oversecured.com/)\n* [Android Observatory APK Scan](https:/androidobservatory.org/upload)\n* [AndroTotal](http://andrototal.org/)\n* [VirusTotal](https://www.virustotal.com/#/home/upload)\n* [Scan Your APK](https://scanyourapk.com/)\n* [AVC Undroid](https://undroid.av-comparatives.org/index.php)\n* [OPSWAT](https://metadefender.opswat.com/#!/)\n* [ImmuniWeb Mobile App Scanner](https://www.htbridge.com/mobile/)\n* [Ostor Lab](https://www.ostorlab.co/scan/mobile/)\n* [Quixxi](https://quixxisecurity.com/)\n* [TraceDroid](http://tracedroid.few.vu.nl/submit.php)\n* [Visual Threat](http://www.visualthreat.com/UIupload.action)\n* [App Critique](https://appcritique.boozallen.com/)\n* [Jotti's malware scan](https://virusscan.jotti.org/)\n* [kaspersky scanner](https://opentip.kaspersky.com/)\n* [Hudson Rock](https://www.hudsonrock.com/threat-intelligence-cybercrime-tools)\n\n#### Online APK Decompiler\n* [Android APK Decompiler](http://www.decompileandroid.com/)\n* [Java  Decompiler APk](http://www.javadecompilers.com/apk)\n* [APK DECOMPILER APP](https://www.apkdecompilers.com/)\n* [DeAPK is an open-source, online APK decompiler ](https://deapk.vaibhavpandey.com/)\n* [apk and dex decompilation back to Java source code](http://www.decompiler.com/)\n* [APK Decompiler Tools](https://apk.tools/tools/apk-decompiler/alternateURL/)\n\n#### Forensic Analysis\n* [Forensic Analysis for Mobile Apps (FAMA)](https://github.com/labcif/FAMA)\n* [Andriller](https://github.com/den4uk/andriller)\n* [Autopsy](https://www.autopsy.com/)\n* [bandicoot](https://github.com/computationalprivacy/bandicoot)\n* [Fridump-A universal memory dumper using Frida](https://github.com/Nightbringer21/fridump)\n* [LiME - Linux Memory Extractor](https://github.com/504ensicsLabs/LiME)\n\n# Labs\n\n* [Damn-Vulnerable-Bank](https://github.com/rewanth1997/Damn-Vulnerable-Bank)  \n* [OVAA (Oversecured Vulnerable Android App)](https://github.com/oversecured/ovaa)\n* [DIVA (Damn insecure and vulnerable App)](https://github.com/payatu/diva-android)\n* [OWASP Security Shepherd ](https://github.com/OWASP/SecurityShepherd)\n* [Damn Vulnerable Hybrid Mobile App (DVHMA)](https://github.com/logicalhacking/DVHMA)\n* [OWASP-mstg(UnCrackable Mobile Apps)](https://github.com/OWASP/owasp-mstg/tree/master/Crackmes)\n* [VulnerableAndroidAppOracle](https://github.com/dan7800/VulnerableAndroidAppOracle)\n* [Android InsecureBankv2](https://github.com/dineshshetty/Android-InsecureBankv2)\n* [Purposefully Insecure and Vulnerable Android Application (PIIVA)](https://github.com/htbridge/pivaa)\n* [Sieve app(An android application which exploits through android components)](https://github.com/mwrlabs/drozer/releases/download/2.3.4/sieve.apk)\n* [DodoVulnerableBank(Insecure Vulnerable Android Application that helps to learn hacing and securing apps)](https://github.com/CSPF-Founder/DodoVulnerableBank)\n* [Digitalbank(Android Digital Bank Vulnerable Mobile App)](https://github.com/CyberScions/Digitalbank)\n* [AppKnox Vulnerable Application](https://github.com/appknox/vulnerable-application)\n* [Vulnerable Android Application](https://github.com/Lance0312/VulnApp)\n* [Android Security Labs](https://github.com/SecurityCompass/AndroidLabs)\n* [Android-security Sandbox](https://github.com/rafaeltoledo/android-security)\n* [VulnDroid(CTF Style Vulnerable Android App)](https://github.com/shahenshah99/VulnDroid)\n* [FridaLab](https://rossmarks.uk/blog/fridalab/)\n* [Santoku Linux - Mobile Security VM](https://santoku-linux.com/)\n* [AndroL4b - A Virtual Machine For Assessing Android applications, Reverse Engineering and Malware Analysis](https://github.com/sh4hin/Androl4b)\n\n  \n# Talks\n  \n* [One Step Ahead of Cheaters -- Instrumenting Android Emulators](https://www.youtube.com/watch?v=L3AniAxp_G4)\n* [Vulnerable Out of the Box: An Evaluation of Android Carrier Devices](https://www.youtube.com/watch?v=R2brQvQeTvM)\n* [Rock appround the clock: Tracking malware developers by Android](https://www.youtube.com/watch?v=wd5OU9NvxjU)\n* [Chaosdata - Ghost in the Droid: Possessing Android Applications with ParaSpectre](https://www.youtube.com/watch?v=ohjTWylMGEA)\n* [Remotely Compromising Android and iOS via a Bug in Broadcom's Wi-Fi Chipsets](https://www.youtube.com/watch?v=TDk2RId8LFo)\n* [Honey, I Shrunk the Attack Surface – Adventures in Android Security Hardening](https://www.youtube.com/watch?v=EkL1sDMXRVk)\n* [Hide Android Applications in Images](https://www.youtube.com/watch?v=hajOlvLhYJY)\n* [Scary Code in the Heart of Android](https://www.youtube.com/watch?v=71YP65UANP0)\n* [Fuzzing Android: A Recipe For Uncovering Vulnerabilities Inside System Components In Android](https://www.youtube.com/watch?v=q_HibdrbIxo)\n* [Unpacking the Packed Unpacker: Reverse Engineering an Android Anti-Analysis Native Library](https://www.youtube.com/watch?v=s0Tqi7fuOSU)\n* [Android FakeID Vulnerability Walkthrough](https://www.youtube.com/watch?v=5eJYCucZ-Tc)\n* [Unleashing D* on Android Kernel Drivers](https://www.youtube.com/watch?v=1XavjjmfZAY)\n* [The Smarts Behind Hacking Dumb Devices](https://www.youtube.com/watch?v=yU1BrY1ZB2o)\n* [Overview of common Android app vulnerabilities](https://www.bugcrowd.com/resources/webinars/overview-of-common-android-app-vulnerabilities/)\n* [Advanced Android Bug Bounty skills](https://www.youtube.com/watch?v=OLgmPxTHLuY)\n* [Android security architecture](https://www.youtube.com/watch?v=3asW-nBU-JU)\n* [Get the Ultimate Privilege of Android Phone](https://vimeo.com/335948808)\n* [Securing the System: A Deep Dive into Reversing Android Pre-Installed Apps](https://www.youtube.com/watch?v=U6qTcpCfuFc)\n* [Bad Binder: Finding an Android In The Wild 0day](https://www.youtube.com/watch?v=TAwQ4ezgEIo)\n* [Deep dive into ART(Android Runtime) for dynamic binary analysis](https://www.youtube.com/watch?v=mFq0vNvUgj8)\n  \n# Misc\n\n* [PhoneSploit with Metasploit Integration](https://github.com/AzeemIdrisi/PhoneSploit-Pro)\n* [Android Malware Adventures](https://docs.google.com/presentation/d/1pYB522E71hXrp4m3fL3E3fnAaOIboJKqpbyE5gSsOes/edit)    \n* [Android-Reports-and-Resources](https://github.com/B3nac/Android-Reports-and-Resources/blob/master/README.md)\n* [Hands On Mobile API Security](https://hackernoon.com/hands-on-mobile-api-security-get-rid-of-client-secrets-a79f111b6844)\n* [Android Penetration Testing Courses](https://medium.com/mobile-penetration-testing/android-penetration-testing-courses-4effa36ac5ed)\n* [Lesser-known Tools for Android Application PenTesting](https://captmeelo.com/pentest/2019/12/30/lesser-known-tools-for-android-pentest.html)\n* [android-device-check - a set of scripts to check Android device security configuration](https://github.com/nelenkov/android-device-check)\n* [apk-mitm - a CLI application that prepares Android APK files for HTTPS inspection](https://github.com/shroudedcode/apk-mitm)\n* [Andriller - is software utility with a collection of forensic tools for smartphones](https://github.com/den4uk/andriller)\n* [Dexofuzzy: Android malware similarity clustering method using opcode sequence-Paper](https://www.virusbulletin.com/virusbulletin/2019/11/dexofuzzy-android-malware-similarity-clustering-method-using-opcode-sequence/)\n* [Chasing the Joker](https://docs.google.com/presentation/d/1sFGAERaNRuEORaH06MmZKeFRqpJo1ol1xFieUa1X_OA/edit#slide=id.p1)\n* [Side Channel Attacks in 4G and 5G Cellular Networks-Slides](https://i.blackhat.com/eu-19/Thursday/eu-19-Hussain-Side-Channel-Attacks-In-4G-And-5G-Cellular-Networks.pdf)\n* [Shodan.io-mobile-app for Android](https://github.com/PaulSec/Shodan.io-mobile-app)\n* [Popular Android Malware 2019](https://github.com/sk3ptre/AndroidMalware_2019)\n* [Popular Android Malware 2020](https://github.com/sk3ptre/AndroidMalware_2020)    \n* [Popular Android Malware 2021](https://github.com/sk3ptre/AndroidMalware_2021)   \n* [Popular Android Malware 2022](https://github.com/sk3ptre/AndroidMalware_2022)       \n   \n# Bug Bounty \u0026 Writeups\n* [Hacker101 CTF: Android Challenge Writeups](https://medium.com/bugbountywriteup/hacker101-ctf-android-challenge-writeups-f830a382c3ce)\n* [Arbitrary code execution on Facebook for Android through download feature](https://medium.com/@dPhoeniixx/arbitrary-code-execution-on-facebook-for-android-through-download-feature-fb6826e33e0f)\n\n* [RCE via Samsung Galaxy Store App](https://labs.f-secure.com/blog/samsung-s20-rce-via-samsung-galaxy-store-app/)\n\n# Cheat Sheet \n* [Mobile Application Penetration Testing Cheat Sheet](https://github.com/sh4hin/MobileApp-Pentest-Cheatsheet)\n* [ADB (Android Debug Bridge) Cheat Sheet](https://www.mobileqaengineer.com/blog/2020/2/4/adb-android-debug-bridge-cheat-sheet)\n* [Frida Cheatsheet and Code Snippets for Android](https://erev0s.com/blog/frida-code-snippets-for-android/)\n\n# Checklists\n* [Android Pentesting Checklist](https://mobexler.com/checklist.htm#android)\n* [OWASP Mobile Security Testing Guide (MSTG)](https://github.com/OWASP/owasp-mstg/tree/master/Checklists)\n* [OWASP Mobile Application Security Verification Standard (MASVS)](https://github.com/OWASP/owasp-masvs)\n\n# Bug Bounty Reports \n* [List of Android Hackerone disclosed reports](https://github.com/B3nac/Android-Reports-and-Resources)\n* [How to report security issues](https://source.android.com/security/overview/updates-resources#report-issues)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsaeidshirazi%2Fawesome-android-security","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsaeidshirazi%2Fawesome-android-security","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsaeidshirazi%2Fawesome-android-security/lists"}