Data

Tools

Indexes

Applications

Experiments

Awesome

An open API service indexing awesome lists of open source software.

android-security-awesome

A collection of android security related resources
https://github.com/ashishb/android-security-awesome

Last synced: 27 days ago
JSON representation

Academic/Research/Publications/Books

Books

Others

Research Papers

📖 Citation

How to report Security issues

Exploits/Vulnerabilities/Bugs

How to report Security issues

List

Malware

Tools

App Repackaging Detectors

  • FSquaDRA - a tool for detecting repackaged Android applications based on app resource hash comparison.

App Vulnerability Scanners

  • Devknox - IDE plugin to build secure Android apps. Not maintained anymore.~~
  • AndroBugs
  • Nogotofail
  • QARK - QARK by LinkedIn is for app developers to scan apps for security issues
  • Ostorlab - Ostorlab free version scans apps in Android Play Store, iOS App Store, and Huawei AppGallery

Dynamic Analysis Tools

  • Androl4b - A Virtual Machine for Assessing Android applications, Reverse Engineering and Malware Analysis
  • AppUse
  • Android Tamer - Virtual / Live Platform for Android Security Professionals~~
  • Appie - Appie is a software package that has been pre-configured to function as an Android Pentesting Environment. It is completely portable and can be carried on a USB stick or smartphone. This is a one-stop answer for all the tools needed in Android Application Security Assessment and an awesome alternative to existing virtual machines.~~
  • Android Malware Analysis Toolkit - (Linux distro) Earlier, it used to be an online analyzer~~
  • Android Reverse Engineering
  • Mercury
  • Cobradroid
  • Decompiler.com - Online APK and Java decompiler
  • House - House: A runtime mobile application analysis toolkit with a Web GUI, powered by Frida, written in Python.
  • Mobile-Security-Framework MobSF - Mobile Security Framework is an intelligent, all-in-one open-source mobile application (Android/iOS) automated pen-testing framework capable of performing static, dynamic analysis, and web API testing.
  • Droidbox
  • Inspeckage - Android Package Inspector - dynamic analysis with API hooks, start unexported activities, and more. (Xposed Module)
  • Android Hooker - Dynamic Java code instrumentation (requires the Substrate Framework)
  • ProbeDroid - Dynamic Java code instrumentation
  • CuckooDroid - Android extension for Cuckoo sandbox
  • Mem - Memory analysis of Android (root required)
  • Android DBI framework
  • Drozer
  • Aurasium - place reference monitoring.
  • Android Linux Kernel modules
  • StaDynA - a system supporting security app analysis in the presence of dynamic code update features (dynamic class loading and reflection). This tool combines static and dynamic analysis of Android applications in order to reveal the hidden/updated behavior and extend static analysis results with this information.
  • DroidAnalytics - incomplete
  • Vezir Project - Virtual Machine for Mobile Application Pentesting and Mobile Malware Analysis
  • MARA - Mobile Application Reverse Engineering and Analysis Framework
  • Taintdroid - requires AOSP compilation
  • Android Malware Sandbox
  • AndroPyTool - a tool for extracting static and dynamic features from Android APKs. It combines different well-known Android app analysis tools such as DroidBox, FlowDroid, Strace, AndroGuard, and VirusTotal analysis.
  • Runtime Mobile Security (RMS) - is a powerful web interface that helps you to manipulate Android and iOS Apps at Runtime
  • Android_application_analyzer - The tool is used to analyze the content of the Android application in local storage.
  • friTap - Intercept SSL/TLS connections with Frida; Allows TLS key extraction and decryption of TLS payload as PCAP on Android in real-time.
  • HacknDroid - A tool designed to automate various Mobile Application Penetration Testing (MAPT) tasks and facilitate interaction with Android devices.
  • adbsploit - tools for exploiting device via ADB
  • Brida - Burp Suite extension that, working as a bridge between Burp and Frida, lets you use and manipulate the applications' own methods while tampering with the traffic exchanged between the applications and their back-end services/servers.
  • MPT - MPT (Mobile Pentest Toolkit) is a must-have solution for your Android penetration testing workflows. This tool allows you to automate security tasks.
  • AuditdAndroid
  • Andriller - a software utility with a collection of forensic tools for smartphones. It performs read-only, forensically sound, non-destructive acquisition from Android devices.
  • DECAF - Dynamic Executable Code Analysis Framework based on QEMU (DroidScope is now an extension to DECAF)
  • Android Security Evaluation Framework - not under active development anymore
  • Mira - Runtime protection analysis platform for third-party Android and iOS apps, enabling AI to use host-app-side shell, Java, Native, and Frida capabilities for environment risk detection and hardening validation.
  • Xposed - equivalent of doing Stub-based code injection but without any modifications to the binary
  • FlutterTap - Zygisk module that bypasses BoringSSL certificate verification inside libflutter.so and redirects the traffic of selected Flutter apps to a proxy. Persistent across reboots, so it needs no Frida session, no cable, and no listening port.
  • Mobix - Authorized Android pentest lab: Frida SSL-pinning/root-detection bypass chain, mitmproxy traffic capture with automatic IDOR flagging, a web dashboard, and a 36-tool MCP server so a Claude Code agent can run the whole scan-to-findings loop itself.
  • ARTist - a flexible open-source instrumentation and hybrid analysis framework for Android apps and Android's Java middleware. It is based on the Android Runtime's (ART) compiler and modifies code during on-device compilation.
  • ViaLab Community Edition

Fuzz Testing

Market Crawlers

Misc Tools

Online Analyzers

Reverse Engineering

Static Analysis Tools

  • DroidLegacy
  • Smali CFG generator
  • FlowDroid
  • Android Decompiler
  • PSCout - A tool that extracts the permission specification from the Android OS source code using static analysis
  • SPARTA - verifies (proves) that an app satisfies an information-flow security policy; built on the Checker Framework~~
  • Several tools from PSU
  • ApkAnalyser
  • SmaliSCA - Smali Static Code Analysis
  • Madrolyzer - extracts actionable data like C&C, phone number etc.
  • ConDroid - Performs a combination of symbolic + concrete execution of the app
  • DroidRA
  • RiskInDroid - A tool for calculating the risk of Android apps based on their permissions, with an online demo available.
  • SUPER - Secure, Unified, Powerful, and Extensible Rust Android Analyzer
  • ClassyShark - A Standalone binary inspection tool that can browse any Android executable and show important info.
  • StaCoAn - Cross-platform tool that aids developers, bug-bounty hunters, and ethical hackers in performing static code analysis on mobile applications. This tool was created with a big focus on usability and graphical guidance in the user interface.