{"id":13476810,"url":"https://github.com/vaib25vicky/awesome-mobile-security","last_synced_at":"2025-09-27T10:31:24.046Z","repository":{"id":37323713,"uuid":"231425210","full_name":"vaib25vicky/awesome-mobile-security","owner":"vaib25vicky","description":"An effort to build a single place for all useful android and iOS security related stuff. All references and tools belong to their respective owners. I'm just maintaining it.","archived":false,"fork":false,"pushed_at":"2024-03-01T10:39:44.000Z","size":363,"stargazers_count":3280,"open_issues_count":9,"forks_count":358,"subscribers_count":110,"default_branch":"master","last_synced_at":"2025-09-12T06:16:14.962Z","etag":null,"topics":["android","android-security","awesome","awesome-list","bugbounty","hacking","hacking-tools","ios","ios-security","mobile","mobile-security","pentesting","redteam","resources","reverse-engineering","security-tools"],"latest_commit_sha":null,"homepage":"","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/vaib25vicky.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null}},"created_at":"2020-01-02T17:06:25.000Z","updated_at":"2025-09-11T21:17:39.000Z","dependencies_parsed_at":"2024-01-05T23:44:44.470Z","dependency_job_id":"1a11eca0-dda1-420d-a9fb-d7fd19d39a45","html_url":"https://github.com/vaib25vicky/awesome-mobile-security","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/vaib25vicky/awesome-mobile-security","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/vaib25vicky%2Fawesome-mobile-security","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/vaib25vicky%2Fawesome-mobile-security/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/vaib25vicky%2Fawesome-mobile-security/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/vaib25vicky%2Fawesome-mobile-security/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/vaib25vicky","download_url":"https://codeload.github.com/vaib25vicky/awesome-mobile-security/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/vaib25vicky%2Fawesome-mobile-security/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":276881834,"owners_count":25721413,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-09-25T02:00:09.612Z","response_time":80,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["android","android-security","awesome","awesome-list","bugbounty","hacking","hacking-tools","ios","ios-security","mobile","mobile-security","pentesting","redteam","resources","reverse-engineering","security-tools"],"created_at":"2024-07-31T16:01:34.879Z","updated_at":"2025-09-27T10:31:24.022Z","avatar_url":"https://github.com/vaib25vicky.png","language":null,"funding_links":[],"categories":["Others","HarmonyOS","Miscellaneous","Resource","Don't forget to give a :star: to make the project popular","Others (1002)","Awesome lists","Other Lists","bugbounty","Awesome Sites","Related Awesome Lists","Terminals"],"sub_categories":["Windows Manager","Uncategorized","TeX Lists","Reconnaissance"],"readme":"# awesome-mobile-security ![awesome](https://awesome.re/badge.svg)\n\n\nMaintained by [@vaib25vicky](https://twitter.com/vaib25vicky) with contributions from the security and developer communities.\n \n\n## Android\n\n### General - Blogs, Papers, How To's\n\n* [Android: Gaining access to arbitrary* Content Providers](https://blog.oversecured.com/Gaining-access-to-arbitrary-Content-Providers/)\n* [Evernote: Universal-XSS, theft of all cookies from all sites, and more](https://blog.oversecured.com/Evernote-Universal-XSS-theft-of-all-cookies-from-all-sites-and-more/)\n* [Interception of Android implicit intents](https://blog.oversecured.com/Interception-of-Android-implicit-intents/)\n* [TikTok: three persistent arbitrary code executions and one theft of arbitrary files](https://blog.oversecured.com/Oversecured-detects-dangerous-vulnerabilities-in-the-TikTok-Android-app/)\n* [Persistent arbitrary code execution in Android's Google Play Core Library: details, explanation and the PoC - CVE-2020-8913](https://blog.oversecured.com/Oversecured-automatically-discovers-persistent-code-execution-in-the-Google-Play-Core-Library/)\n* [Android: Access to app protected components](https://blog.oversecured.com/Android-Access-to-app-protected-components/)\n* [Android: arbitrary code execution via third-party package contexts](https://blog.oversecured.com/Android-arbitrary-code-execution-via-third-party-package-contexts/)\n* [Android Pentesting Labs - Step by Step guide for beginners](https://medium.com/bugbountywriteup/android-pentesting-lab-4a6fe1a1d2e0)\n* [An Android Hacking Primer](https://medium.com/swlh/an-android-hacking-primer-3390fef4e6a0)\n* [Secure an Android Device](https://source.android.com/security)\n* [Security tips](https://developer.android.com/training/articles/security-tips)\n* [OWASP Mobile Security Testing Guide](https://www.owasp.org/index.php/OWASP_Mobile_Security_Testing_Guide)\n* [Security Testing for Android Cross Platform Application](https://3xpl01tc0d3r.blogspot.com/2019/09/security-testing-for-android-app-part1.html)\n* [Dive deep into Android Application Security](https://blog.0daylabs.com/2019/09/18/deep-dive-into-Android-security/)\n* [Pentesting Android Apps Using Frida](https://www.notsosecure.com/pentesting-android-apps-using-frida/)\n* [Mobile Security Testing Guide](https://mobile-security.gitbook.io/mobile-security-testing-guide/)\n* [Mobile Application Penetration Testing Cheat Sheet](https://github.com/sh4hin/MobileApp-Pentest-Cheatsheet)\n* [Android Applications Reversing 101](https://www.evilsocket.net/2017/04/27/Android-Applications-Reversing-101/#.WQND0G3TTOM.reddit)\n* [Android Security Guidelines](https://developer.box.com/en/guides/security/)\n* [Android WebView Vulnerabilities](https://pentestlab.blog/2017/02/12/android-webview-vulnerabilities/)\n* [OWASP Mobile Top 10](https://www.owasp.org/index.php/OWASP_Mobile_Top_10)\n* [Practical Android Phone Forensics](https://resources.infosecinstitute.com/practical-android-phone-forensics/)\n* [Mobile Reverse Engineering Unleashed](http://www.vantagepoint.sg/blog/83-mobile-reverse-engineering-unleashed)\n* [Android Root Detection Bypass Using Objection and Frida Scripts](https://medium.com/@GowthamR1/android-root-detection-bypass-using-objection-and-frida-scripts-d681d30659a7)\n* [quark-engine - An Obfuscation-Neglect Android Malware Scoring System](https://github.com/quark-engine/quark-engine)\n* [Root Detection Bypass By Manual Code Manipulation.](https://medium.com/@sarang6489/root-detection-bypass-by-manual-code-manipulation-5478858f4ad1)\n* [Application and Network Usage in Android](https://www.sans.org/cyber-security-summit/archives/file/summit-archive-1528491463.pdf)\n* [GEOST BOTNET - the discovery story of a new Android banking trojan](http://public.avast.com/research/VB2019-Garcia-etal.pdf)\n* [Mobile Pentesting With Frida](https://drive.google.com/file/d/1JccmMLi6YTnyRrp_rk6vzKrUX3oXK_Yw/view)\n* [Magisk Systemless Root - Detection and Remediation](https://www.mobileiron.com/en/blog/magisk-android-rooting)\n* [AndrODet: An adaptive Android obfuscation detector](https://arxiv.org/pdf/1910.06192.pdf)\n* [Hands On Mobile API Security](https://hackernoon.com/hands-on-mobile-api-security-get-rid-of-client-secrets-a79f111b6844)\n* [Zero to Hero - Mobile Application Testing - Android Platform](https://nileshsapariya.blogspot.com/2016/11/zero-to-hero-mobile-application-testing.html)\n* [How to use FRIDA to bruteforce Secure Startup with FDE-encryption on a Samsung G935F running Android 8](https://github.com/Magpol/fridafde)\n* [Android Malware Adventures](https://docs.google.com/presentation/d/1pYB522E71hXrp4m3fL3E3fnAaOIboJKqpbyE5gSsOes/edit)\n* [AAPG - Android application penetration testing guide](https://nightowl131.github.io/AAPG/)\n* [Bypassing Android Anti-Emulation](https://www.juanurs.com/Bypassing-Android-Anti-Emulation-Part-I/)\n* [Bypassing Xamarin Certificate Pinning](https://www.gosecure.net/blog/2020/04/06/bypassing-xamarin-certificate-pinning-on-android/)\n* [Configuring Burp Suite With Android Nougat](https://blog.ropnop.com/configuring-burp-suite-with-android-nougat/)\n\n    \n### Books\n\n * [SEI CERT Android Secure Coding Standard](https://www.securecoding.cert.org/confluence/display/android/Android+Secure+Coding+Standard)\n * [Android Security Internals](https://www.oreilly.com/library/view/android-security-internals/9781457185496/)\n * [Android Cookbook](https://androidcookbook.com/)\n * [Android Hacker's Handbook](https://www.amazon.com/Android-Hackers-Handbook-Joshua-Drake/dp/111860864X)\n * [Android Security Cookbook](https://www.packtpub.com/in/application-development/android-security-cookbook)\n * [The Mobile Application Hacker's Handbook](https://www.amazon.in/Mobile-Application-Hackers-Handbook-ebook/dp/B00TSA6KLG)\n * [Android Malware and Analysis](https://www.oreilly.com/library/view/android-malware-and/9781482252200/)\n * [Android Security: Attacks and Defenses](https://www.crcpress.com/Android-Security-Attacks-and-Defenses/Misra-Dubey/p/book/9780367380182)\n \n### Courses\n \n* [Learning-Android-Security](https://www.lynda.com/Android-tutorials/Learning-Android-Security/689762-2.html)\n* [Mobile Application Security and Penetration Testing](https://www.elearnsecurity.com/course/mobile_application_security_and_penetration_testing/)\n* [Advanced Android Development](https://developer.android.com/courses/advanced-training/overview)\n* [Learn the art of mobile app development](https://www.edx.org/professional-certificate/harvardx-computer-science-and-mobile-apps)\n* [Learning Android Malware Analysis](https://www.linkedin.com/learning/learning-android-malware-analysis)\n* [Android App Reverse Engineering 101](https://maddiestone.github.io/AndroidAppRE/)\n* [Android Pentesting for Beginners](https://manifestsecurity.com/android-application-security/)\n  \n### Tools\n     \n#### Static Analysis\n\n* [Amandroid – A Static Analysis Framework](http://pag.arguslab.org/argus-saf)\n* [Androwarn – Yet Another Static Code Analyzer](https://github.com/maaaaz/androwarn/)\n* [APK Analyzer – Static and Virtual Analysis Tool](https://github.com/sonyxperiadev/ApkAnalyser)\n* [APK Inspector – A Powerful GUI Tool](https://github.com/honeynet/apkinspector/)\n* [Droid Hunter – Android application vulnerability analysis and Android pentest tool](https://github.com/hahwul/droid-hunter)\n* [Error Prone – Static Analysis Tool](https://github.com/google/error-prone)\n* [Findbugs – Find Bugs in Java Programs](http://findbugs.sourceforge.net/downloads.html)\n* [Find Security Bugs – A SpotBugs plugin for security audits of Java web applications.](https://github.com/find-sec-bugs/find-sec-bugs/)\n* [Flow Droid – Static Data Flow Tracker](https://github.com/secure-software-engineering/FlowDroid)\n* [Smali/Baksmali – Assembler/Disassembler for the dex format](https://github.com/JesusFreke/smali)\n* [Smali-CFGs – Smali Control Flow Graph’s](https://github.com/EugenioDelfa/Smali-CFGs)\n* [SPARTA – Static Program Analysis for Reliable Trusted Apps](https://www.cs.washington.edu/sparta)\n* [Thresher – To check heap reachability properties](https://plv.colorado.edu/projects/thresher/)\n* [Vector Attack Scanner – To search vulnerable points to attack](https://github.com/Sukelluskello/VectorAttackScanner)\n* [Gradle Static Analysis Plugin](https://github.com/novoda/gradle-static-analysis-plugin)\n* [Checkstyle – A tool for checking Java source code](https://github.com/checkstyle/checkstyle)\n* [PMD – An extensible multilanguage static code analyzer](https://github.com/pmd/pmd)\n* [Soot – A Java Optimization Framework](https://github.com/Sable/soot)\n* [Android Quality Starter](https://github.com/pwittchen/android-quality-starter)\n* [QARK – Quick Android Review Kit](https://github.com/linkedin/qark)\n* [Infer – A Static Analysis tool for Java, C, C++ and Objective-C](https://github.com/facebook/infer)\n* [Android Check – Static Code analysis plugin for Android Project](https://github.com/noveogroup/android-check)\n* [FindBugs-IDEA Static byte code analysis to look for bugs in Java code](https://plugins.jetbrains.com/plugin/3847-findbugs-idea)\n* [APK Leaks – Scanning APK file for URIs, endpoints \u0026 secrets](https://github.com/dwisiswant0/apkleaks)\n      \n#### Dynamic Analysis\n\n* [Adhrit - Android Security Suite for in-depth reconnaissance and static bytecode analysis based on Ghera benchmarks](https://github.com/abhi-r3v0/Adhrit)\n* [Android Hooker - Opensource project for dynamic analyses of Android applications](https://github.com/AndroidHooker/hooker)\n* [AppAudit - Online tool ( including an API) uses dynamic and static analysis](http://appaudit.io/)\n* [AppAudit - A bare-metal analysis tool on Android devices](https://github.com/ucsb-seclab/baredroid)\n* [CuckooDroid - Extension of Cuckoo Sandbox the Open Source software](https://github.com/idanr1986/cuckoo-droid)\n* [DroidBox - Dynamic analysis of Android applications](https://code.google.com/p/droidbox/)\n* [Droid-FF - Android File Fuzzing Framework](https://github.com/antojoseph/droid-ff)\n* [Drozer](https://www.mwrinfosecurity.com/products/drozer/)\n* [Marvin - Analyzes Android applications and allows tracking of an app](https://github.com/programa-stic/marvin-django)\n* [Inspeckage](https://github.com/ac-pm/Inspeckage)\n* [PATDroid - Collection of tools and data structures for analyzing Android applications](https://github.com/mingyuan-xia/PATDroid)\n* [AndroL4b - Android security virtual machine based on ubuntu-mate](https://github.com/sh4hin/Androl4b)\n* [Radare2 - Unix-like reverse engineering framework and commandline tools](https://github.com/radareorg/radare2)\n* [Cutter - Free and Open Source RE Platform powered by radare2](https://cutter.re/)\n* [ByteCodeViewer - Android APK Reverse Engineering Suite (Decompiler, Editor, Debugger)](https://bytecodeviewer.com/)\n* [Mobile-Security-Framework MobSF](https://github.com/MobSF/Mobile-Security-Framework-MobSF)\n* [CobraDroid - Custom build of the Android operating system geared specifically for application security ](https://thecobraden.com/projects/cobradroid/)\n* [Magisk v20.2 - Root \u0026 Universal Systemless Interface](https://forum.xda-developers.com/apps/magisk/official-magisk-v7-universal-systemless-t3473445)\n* [Runtime Mobile Security (RMS) - is a powerful web interface that helps you to manipulate Android and iOS Apps at Runtime](https://github.com/m0bilesecurity/RMS-Runtime-Mobile-Security)\n* [MOBEXLER - A Mobile Application Penetration Testing Platform](https://mobexler.com/)\n\n        \n#### Android Online APK Analyzers\n\n* [Oversecured](https://oversecured.com/) - A static vulnerability scanner for Android apps (APK files) containing 90+ vulnerability categories\n* [Android Observatory APK Scan](https://androidobservatory.org/upload)\n* [Android APK Decompiler](http://www.decompileandroid.com/)\n* [AndroTotal](http://andrototal.org/)\n* [NVISO ApkScan](https://apkscan.nviso.be/)\n* [VirusTotal](https://www.virustotal.com/#/home/upload)\n* [Scan Your APK](https://scanyourapk.com/)\n* [AVC Undroid](https://undroid.av-comparatives.org/index.php)\n* [OPSWAT](https://metadefender.opswat.com/#!/)\n* [ImmuniWeb Mobile App Scanner](https://www.htbridge.com/mobile/)\n* [Ostor Lab](https://www.ostorlab.co/scan/mobile/)\n* [Quixxi](https://quixxisecurity.com/)\n* [TraceDroid](http://tracedroid.few.vu.nl/submit.php)\n* [Visual Threat](http://www.visualthreat.com/UIupload.action)\n* [App Critique](https://appcritique.boozallen.com/)\n        \n### Labs\n  \n* [OVAA (Oversecured Vulnerable Android App)](https://github.com/oversecured/ovaa)\n* [DIVA (Damn insecure and vulnerable App)](https://github.com/payatu/diva-android)\n* [SecurityShepherd](https://github.com/OWASP/SecurityShepherd)\n* [Damn Vulnerable Hybrid Mobile App (DVHMA)](https://github.com/logicalhacking/DVHMA)\n* [OWASP-mstg](https://github.com/OWASP/owasp-mstg/tree/master/Crackmes)\n* [VulnerableAndroidAppOracle](https://github.com/dan7800/VulnerableAndroidAppOracle)\n* [Android InsecureBankv2](https://github.com/dineshshetty/Android-InsecureBankv2)\n* [Purposefully Insecure and Vulnerable Android Application (PIIVA)](https://github.com/htbridge/pivaa)\n* [Sieve app](https://github.com/mwrlabs/drozer/releases/download/2.3.4/sieve.apk)\n* [DodoVulnerableBank](https://github.com/CSPF-Founder/DodoVulnerableBank)\n* [Digitalbank](https://github.com/CyberScions/Digitalbank)\n* [OWASP GoatDroid](https://github.com/jackMannino/OWASP-GoatDroid-Project)\n* [AppKnox Vulnerable Application](https://github.com/appknox/vulnerable-application)\n* [Vulnerable Android Application](https://github.com/Lance0312/VulnApp)\n* [MoshZuk](https://dl.dropboxusercontent.com/u/37776965/Work/MoshZuk.apk)\n* [Hackme Bank](http://www.mcafee.com/us/downloads/free-tools/hacme-bank-android.aspx)\n* [Android Security Labs](https://github.com/SecurityCompass/AndroidLabs)\n* [Android-InsecureBankv2](https://github.com/dineshshetty/Android-InsecureBankv2)\n* [Android-security](https://github.com/rafaeltoledo/android-security)\n* [VulnDroid](https://github.com/shahenshah99/VulnDroid)\n* [FridaLab](https://rossmarks.uk/blog/fridalab/)\n* [Santoku Linux - Mobile Security VM](https://santoku-linux.com/)\n* [Vuldroid](https://github.com/jaiswalakshansh/Vuldroid)\n\n  \n### Talks\n\n* [Blowing the Cover of Android Binary Fuzzing (Slides)](https://speakerdeck.com/flankerhqd/blowing-the-cover-of-android-binary-fuzzing)\n* [One Step Ahead of Cheaters -- Instrumenting Android Emulators](https://www.youtube.com/watch?v=L3AniAxp_G4)\n* [Vulnerable Out of the Box: An Evaluation of Android Carrier Devices](https://www.youtube.com/watch?v=R2brQvQeTvM)\n* [Rock appround the clock: Tracking malware developers by Android](https://www.youtube.com/watch?v=wd5OU9NvxjU)\n* [Chaosdata - Ghost in the Droid: Possessing Android Applications with ParaSpectre](https://www.youtube.com/watch?v=ohjTWylMGEA)\n* [Remotely Compromising Android and iOS via a Bug in Broadcom's Wi-Fi Chipsets](https://www.youtube.com/watch?v=TDk2RId8LFo)\n* [Honey, I Shrunk the Attack Surface – Adventures in Android Security Hardening](https://www.youtube.com/watch?v=EkL1sDMXRVk)\n* [Hide Android Applications in Images](https://www.youtube.com/watch?v=hajOlvLhYJY)\n* [Scary Code in the Heart of Android](https://www.youtube.com/watch?v=71YP65UANP0)\n* [Fuzzing Android: A Recipe For Uncovering Vulnerabilities Inside System Components In Android](https://www.youtube.com/watch?v=q_HibdrbIxo)\n* [Unpacking the Packed Unpacker: Reverse Engineering an Android Anti-Analysis Native Library](https://www.youtube.com/watch?v=s0Tqi7fuOSU)\n* [Android FakeID Vulnerability Walkthrough](https://www.youtube.com/watch?v=5eJYCucZ-Tc)\n* [Unleashing D* on Android Kernel Drivers](https://www.youtube.com/watch?v=1XavjjmfZAY)\n* [The Smarts Behind Hacking Dumb Devices](https://www.youtube.com/watch?v=yU1BrY1ZB2o)\n* [Overview of common Android app vulnerabilities](https://www.bugcrowd.com/resources/webinars/overview-of-common-android-app-vulnerabilities/)\n* [Android Dev Summit 2019](https://developer.android.com/dev-summit)\n* [Android security architecture](https://www.youtube.com/watch?v=3asW-nBU-JU)\n* [Get the Ultimate Privilege of Android Phone](https://vimeo.com/335948808)\n  \n### Misc.\n    \n* [Android-Reports-and-Resources](https://github.com/B3nac/Android-Reports-and-Resources/blob/master/README.md)\n* [android-security-awesome](https://github.com/ashishb/android-security-awesome)\n* [Android Penetration Testing Courses](https://medium.com/mobile-penetration-testing/android-penetration-testing-courses-4effa36ac5ed)\n* [Lesser-known Tools for Android Application PenTesting](https://captmeelo.com/pentest/2019/12/30/lesser-known-tools-for-android-pentest.html)\n* [android-device-check - a set of scripts to check Android device security configuration](https://github.com/nelenkov/android-device-check)\n* [apk-mitm - a CLI application that prepares Android APK files for HTTPS inspection](https://github.com/shroudedcode/apk-mitm)\n* [Andriller - is software utility with a collection of forensic tools for smartphones](https://github.com/den4uk/andriller)\n* [Dexofuzzy: Android malware similarity clustering method using opcode sequence-Paper](https://www.virusbulletin.com/virusbulletin/2019/11/dexofuzzy-android-malware-similarity-clustering-method-using-opcode-sequence/)\n* [Chasing the Joker](https://docs.google.com/presentation/d/1sFGAERaNRuEORaH06MmZKeFRqpJo1ol1xFieUa1X_OA/edit#slide=id.p1)\n* [Side Channel Attacks in 4G and 5G Cellular Networks-Slides](https://i.blackhat.com/eu-19/Thursday/eu-19-Hussain-Side-Channel-Attacks-In-4G-And-5G-Cellular-Networks.pdf)\n* [Shodan.io-mobile-app for Android](https://github.com/PaulSec/Shodan.io-mobile-app)\n* [Popular Android Malware 2018](https://github.com/sk3ptre/AndroidMalware_2018)\n* [Popular Android Malware 2019](https://github.com/sk3ptre/AndroidMalware_2019)\n* [Popular Android Malware 2020](https://github.com/sk3ptre/AndroidMalware_2020)    \n    \n   \n## iOS\n\n### General - Blogs, Papers, How to's\n\n* [iOS Security](https://www.cse.wustl.edu/~jain/cse571-14/ftp/ios_security/index.html)\n* [Basic iOS Apps Security Testing lab](https://medium.com/@ehsahil/basic-ios-apps-security-testing-lab-1-2bf37c2a7d15)\n* [IOS Application security – Setting up a mobile pentesting platform](https://resources.infosecinstitute.com/ios-application-security-part-1-setting-up-a-mobile-pentesting-platform/#gref)\n* [Collection of the most common vulnerabilities found in iOS applications](https://github.com/felixgr/secure-ios-app-dev)\n* [IOS_Application_Security_Testing_Cheat_Sheet](https://www.owasp.org/index.php/IOS_Application_Security_Testing_Cheat_Sheet)\n* [OWASP iOS Basic Security Testing](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06b-basic-security-testing)\n* [Dynamic analysis of iOS apps w/o Jailbreak](https://medium.com/@ansjdnakjdnajkd/dynamic-analysis-of-ios-apps-wo-jailbreak-1481ab3020d8)\n* [iOS Application Injection](https://arjunbrar.com/post/ios-application-injection)\n* [Low-Hanging Apples: Hunting Credentials and Secrets in iOS Apps](https://spaceraccoon.dev/low-hanging-apples-hunting-credentials-and-secrets-in-ios-apps)\n* [Checkra1n Era - series](https://blog.digital-forensics.it/)\n* [BFU Extraction: Forensic Analysis of Locked and Disabled iPhones](https://blog.elcomsoft.com/2019/12/bfu-extraction-forensic-analysis-of-locked-and-disabled-iphones/)\n* [HowTo-decrypt-Signal.sqlite-for-IOS](https://github.com/Magpol/HowTo-decrypt-Signal.sqlite-for-IOS)\n* [Can I Jailbreak?](https://canijailbreak.com/)\n* [How to Extract Screen Time Passcodes and Voice Memos from iCloud](https://blog.elcomsoft.com/2019/10/how-to-extract-screen-time-passcodes-and-voice-memos-from-icloud/)\n* [Reverse Engineering Swift Apps](https://github.com/iOS-Reverse-Engineering-Dev/Swift-Apps-Reverse-Engineering/blob/master/Reverse%20Engineering%20Swift%20Applications.pdf)\n* [Mettle your iOS with FRIDA](https://sensepost.com/blog/2019/mettle-your-ios-with-frida/)\n* [A run-time approach for pentesting iOS applications](https://blog.securelayer7.net/a-run-time-approach-for-pen-testing-ios-applications-part-ii-objection-in-action/)\n* [iOS Internals vol 2](http://newosxbook.com/bonus/iBoot.pdf)\n* [Understanding usbmux and the iOS lockdown service](https://medium.com/@jon.gabilondo.angulo_7635/understanding-usbmux-and-the-ios-lockdown-service-7f2a1dfd07ae)\n* [A Deep Dive into iOS Code Signing](https://blog.umangis.me/a-deep-dive-into-ios-code-signing/)\n* [AirDoS: remotely render any nearby iPhone or iPad unusable](https://kishanbagaria.com/airdos/)\n* [How to access and traverse a #checkra1n jailbroken iPhone File system using SSH](https://aboutdfir.com/jailbreaking-checkra1n-configuration/)\n* [Deep dive into iOS Exploit chains found in the wild - Project Zero](https://googleprojectzero.blogspot.com/2019/08/a-very-deep-dive-into-ios-exploit.html)\n* [The Fully Remote Attack Surface of the iPhone - Project Zero](https://googleprojectzero.blogspot.com/2019/08/the-fully-remote-attack-surface-of.html)\n\n\n### Books\n\n* [Hacking and Securing iOS Applications: Stealing Data, Hijacking Software, and How to Prevent It](https://www.amazon.com/Hacking-Securing-iOS-Applications-Hijacking/dp/1449318746)\n* [iOS Penetration Testing](https://www.apress.com/gp/book/9781484223543)\n* [iOS App Security, Penetration Testing, and Development](https://www.allysonomalley.com/)\n* [IOS Hacker's Handbook](https://www.amazon.com/iOS-Hackers-Handbook-Charlie-Miller/dp/1118204123)\n* [Hacking iOS Applications a detailed testing guide](https://web.securityinnovation.com/hubfs/iOS%20Hacking%20Guide.pdf)\n* [Develop iOS Apps (Swift)](https://developer.apple.com/library/archive/referencelibrary/GettingStarted/DevelopiOSAppsSwift/)\n* [iOS Programming Cookbook](https://www.packtpub.com/in/application-development/ios-programming-cookbook)\n\n### Courses\n\n* [Pentesting iOS Applications](https://www.pentesteracademy.com/course?id=2)\n* [Reverse Engineering iOS Applications](https://github.com/ivRodriguezCA/RE-iOS-Apps)\n* [App Design and Development for iOS](https://www.coursera.org/learn/ios-app-design-development)\n\n### Tools\n\n* [Cydia Impactor](http://www.cydiaimpactor.com/)\n* [checkra1n jailbreak](https://checkra.in/)\n* [idb - iOS App Security Assessment Tool](https://www.idbtool.com/)\n* [Frida](https://github.com/frida/frida/releases)\n* [Objection - mobile exploration toolkit by Frida](https://github.com/sensepost/objection)\n* [Bfinject](https://github.com/BishopFox/bfinject)\n* [iFunbox](http://www.i-funbox.com/)\n* [Libimobiledevice - library to communicate with the services of the Apple ios devices](https://www.libimobiledevice.org/)\n* [iRET (iOS Reverse Engineering Toolkit)](https://www.veracode.com/sites/default/files/Resources/Tools/iRETTool.zip) - includes oTool, dumpDecrypted, SQLite, Theos, Keychain_dumper, Plutil\n* [Myriam iOS](https://github.com/GeoSn0w/Myriam)\n* [iWep Pro - wireless suite of useful applications used to turn your iOS device into a wireless network diagnostic tool](https://itunes.apple.com/us/app/iweppro/id578135585?mt=8)\n* [Burp Suite](https://portswigger.net/burp/communitydownload)\n* [Cycript](https://cydia.saurik.com/api/latest/3)\n* [needle - The iOS Security Testing Framework](https://github.com/FSecureLABS/needle)\n* [iLEAPP - iOS Logs, Events, And Preferences Parser](https://github.com/abrignoni/iLEAPP)\n* [Cutter - Free and Open Source RE Platform powered by radare2](https://cutter.re/)\n* [decrypt0r - automatically download and decrypt SecureRom stuff](https://github.com/shinvou/decrypt0r)\n* [iOS Security Suite - an advanced and easy-to-use platform security \u0026 anti-tampering library](https://github.com/securing/IOSSecuritySuite)\n\n### Labs\n\n* [OWASP iGoat](https://www.owasp.org/index.php/OWASP_iGoat_Tool_Project)\n* [Damn Vulnerable iOS App (DVIA) v2](https://github.com/prateek147/DVIA-v2)\n* [Damn Vulnerable iOS App (DVIA) v1](https://github.com/prateek147/DVIA)\n* [iPhoneLabs](https://github.com/SecurityCompass/iPhoneLabs)\n* [iOS-Attack-Defense](https://github.com/ManicodeSecurity/iOS-Attack-Defense)\n\n### Talks\n\n* [Behind the Scenes of iOS Security](https://www.youtube.com/watch?v=BLGFriOKz6U)\n* [Modern iOS Application Security](https://www.infoq.com/presentations/ios-security/)\n* [Demystifying the Secure Enclave Processor](https://www.youtube.com/watch?v=7UNeUT_sRos)\n* [HackPac Hacking Pointer Authentication in iOS User Space](https://www.youtube.com/watch?v=DJFxhShJ6Ns)\n* [Analyzing and Attacking Apple Kernel Drivers](https://www.youtube.com/watch?v=07VqX4bbXTI)\n* [Remotely Compromising iOS via Wi-Fi and Escaping the Sandbox](https://www.youtube.com/watch?v=bP5VP7vLLKo)\n* [Reverse Engineering iOS Mobile Apps](https://www.bugcrowd.com/resources/webinars/reverse-engineering-ios-mobile-apps/)\n* [iOS 10 Kernel Heap Revisited](https://www.youtube.com/watch?v=DNW6Im31lQo)\n* [KTRW: The journey to build a debuggable iPhone](https://media.ccc.de/v/36c3-10806-ktrw_the_journey_to_build_a_debuggable_iphone)\n* [The One Weird Trick SecureROM Hates](https://media.ccc.de/v/36c3-11238-the_one_weird_trick_securerom_hates)\n* [Tales of old: untethering iOS 11-Spoiler: Apple is bad at patching](https://media.ccc.de/v/36c3-11034-tales_of_old_untethering_ios_11)\n* [Messenger Hacking: Remotely Compromising an iPhone through iMessage](https://media.ccc.de/v/36c3-10497-messenger_hacking_remotely_compromising_an_iphone_through_imessage)\n* [Recreating An iOS 0-Day Jailbreak Out Of Apple's Security Updates](https://www.youtube.com/watch?v=p512McKXukU)\n* [Reverse Engineering the iOS Simulator’s SpringBoard](https://vimeo.com/231806976)\n* [Attacking iPhone XS Max](https://www.youtube.com/watch?v=8cOx7vfszZU\u0026feature=youtu.be)\n\n\n\n### Misc.\n  \n* [Most usable tools for iOS penetration testing](https://github.com/ansjdnakjdnajkd/iOS)\n* [iOS-Security-Guides](https://github.com/0xmachos/iOS-Security-Guides)\n* [osx-security-awesome - OSX and iOS related security tools](https://github.com/ashishb/osx-and-ios-security-awesome)    \n* [Trust in Apple's Secret Garden: Exploring \u0026 Reversing Apple's Continuity Protocol-Slides](https://i.blackhat.com/eu-19/Thursday/eu-19-Yen-Trust-In-Apples-Secret-Garden-Exploring-Reversing-Apples-Continuity-Protocol-3.pdf)\n* [Apple Platform Security](https://manuals.info.apple.com/MANUALS/1000/MA1902/en_US/apple-platform-security-guide.pdf)\n* [Mobile security, forensics \u0026 malware analysis with Santoku Linux](https://2013.appsecusa.org/2013/wp-content/uploads/2013/12/viaForensics-AppSecUSA-Nov-2013.pdf)\n\n    \n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fvaib25vicky%2Fawesome-mobile-security","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fvaib25vicky%2Fawesome-mobile-security","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fvaib25vicky%2Fawesome-mobile-security/lists"}