Data

Tools

Indexes

Applications

Experiments

Awesome

An open API service indexing awesome lists of open source software.

fucking-android-security-awesome

A collection of android security related resources. With repository stars⭐ and forks🍴
https://github.com/Correia-jpv/fucking-android-security-awesome

Last synced: 11 days ago
JSON representation

Academic/Research/Publications/Books

Others

Research Papers

Exploits/Vulnerabilities/Bugs

How to report Security issues

Malware

Source

How to report Security issues

Tools

App Repackaging Detectors

  • FSquaDRA - a tool for detecting repackaged Android applications based on app resource hash comparison.

App Vulnerability Scanners

Dynamic Analysis Tools

  • Androl4b - A Virtual Machine for Assessing Android applications, Reverse Engineering and Malware Analysis
  • Android Malware Analysis Toolkit - (Linux distro) Earlier, it used to be an online analyzer~~
  • Android DBI framework
  • House - House: A runtime mobile application analysis toolkit with a Web GUI, powered by Frida, written in Python.
  • Mobile-Security-Framework MobSF - Mobile Security Framework is an intelligent, all-in-one open-source mobile application (Android/iOS) automated pen-testing framework capable of performing static, dynamic analysis, and web API testing.
  • Droidbox
  • Drozer
  • Inspeckage - Android Package Inspector - dynamic analysis with API hooks, start unexported activities, and more. (Xposed Module)
  • Android Hooker - Dynamic Java code instrumentation (requires the Substrate Framework)
  • ProbeDroid - Dynamic Java code instrumentation
  • CuckooDroid - Android extension for Cuckoo sandbox
  • Mem - Memory analysis of Android (root required)
  • Aurasium - place reference monitoring.
  • Android Linux Kernel modules
  • StaDynA - a system supporting security app analysis in the presence of dynamic code update features (dynamic class loading and reflection). This tool combines static and dynamic analysis of Android applications in order to reveal the hidden/updated behavior and extend static analysis results with this information.
  • DroidAnalytics - incomplete
  • Vezir Project - Virtual Machine for Mobile Application Pentesting and Mobile Malware Analysis
  • MARA - Mobile Application Reverse Engineering and Analysis Framework
  • Taintdroid - requires AOSP compilation
  • Android Malware Sandbox
  • AndroPyTool - a tool for extracting static and dynamic features from Android APKs. It combines different well-known Android app analysis tools such as DroidBox, FlowDroid, Strace, AndroGuard, and VirusTotal analysis.
  • Runtime Mobile Security (RMS) - is a powerful web interface that helps you to manipulate Android and iOS Apps at Runtime
  • Android_application_analyzer - The tool is used to analyze the content of the Android application in local storage.
  • friTap - Intercept SSL/TLS connections with Frida; Allows TLS key extraction and decryption of TLS payload as PCAP on Android in real-time.
  • HacknDroid - A tool designed to automate various Mobile Application Penetration Testing (MAPT) tasks and facilitate interaction with Android devices.
  • adbsploit - tools for exploiting device via ADB
  • Brida - Burp Suite extension that, working as a bridge between Burp and Frida, lets you use and manipulate the applications' own methods while tampering with the traffic exchanged between the applications and their back-end services/servers.
  • MPT - MPT (Mobile Pentest Toolkit) is a must-have solution for your Android penetration testing workflows. This tool allows you to automate security tasks.
  • Andriller - a software utility with a collection of forensic tools for smartphones. It performs read-only, forensically sound, non-destructive acquisition from Android devices.
  • AuditdAndroid
  • DECAF - Dynamic Executable Code Analysis Framework based on QEMU (DroidScope is now an extension to DECAF)
  • Mira - Runtime protection analysis platform for third-party Android and iOS apps, enabling AI to use host-app-side shell, Java, Native, and Frida capabilities for environment risk detection and hardening validation.
  • FlutterTap - Zygisk module that bypasses BoringSSL certificate verification inside libflutter.so and redirects the traffic of selected Flutter apps to a proxy. Persistent across reboots, so it needs no Frida session, no cable, and no listening port.
  • Mobix - Authorized Android pentest lab: Frida SSL-pinning/root-detection bypass chain, mitmproxy traffic capture with automatic IDOR flagging, a web dashboard, and a 36-tool MCP server so a Claude Code agent can run the whole scan-to-findings loop itself.

Fuzz Testing

Market Crawlers

Misc Tools

Online Analyzers

Reverse Engineering

Static Analysis Tools

  • Smali CFG generator
  • Several tools from PSU
  • Androwarn - detects and warns the user about potential malicious behaviors developed by an Android application.
  • ApkAnalyser
  • SmaliSCA - Smali Static Code Analysis
  • Madrolyzer - extracts actionable data like C&C, phone number etc.
  • ConDroid - Performs a combination of symbolic + concrete execution of the app
  • DroidRA
  • RiskInDroid - A tool for calculating the risk of Android apps based on their permissions, with an online demo available.
  • SUPER - Secure, Unified, Powerful, and Extensible Rust Android Analyzer
  • ClassyShark - A Standalone binary inspection tool that can browse any Android executable and show important info.
  • StaCoAn - Cross-platform tool that aids developers, bug-bounty hunters, and ethical hackers in performing static code analysis on mobile applications. This tool was created with a big focus on usability and graphical guidance in the user interface.
  • JAADAS - Joint intraprocedural and interprocedural program analysis tool to find vulnerabilities in Android apps, built on Soot and Scala
  • Quark-Engine - An Obfuscation-Neglect Android Malware Scoring System
  • APKLeaks - Scanning APK file for URIs, endpoints & secrets.
  • Mobile Audit - Web application for performing Static Analysis and detecting malware in Android APKs.
  • Detekt - Static code analysis for Kotlin
  • CFGScanDroid - Scans and compares the CFG against the CFG of malicious applications
  • APKdevastate - Advanced analysis software for APK payloads created by RATs.
  • APKInspector
  • One Step Decompiler - Android APK Decompilation for the Lazy

Vulnerable Applications for practice