android-security-awesome

Android security toolkit

A curated collection of resources and tools for securing Android applications

A collection of android security related resources

GitHub

8k stars
437 watching
1k forks
Language: Shell
last commit: almost 2 years ago
Linked from 18 awesome lists

androidawesomeawesome-listlistsecurity

android-security-awesome / Tools / Online Analyzers

AndroTotal
Appknoxnot free
Virustotalmax 128MB
Fraunhofer App-raynot free
NowSecure Lab AutomatedEnterprise tool for mobile app security testing both Android and iOS mobile apps. Lab Automated features dynamic and static analysis on real devices in the cloud to return results in minutes. Not free
App DetonatorDetonate APK binary to provide source code level details including app author, signature, build, and manifest information. 3 Analysis/day free quota
PithusOpen-Source APK analyzer. Still in Beta for the moment and limited to static analysis for the moment. It is possible to hunt malware with Yara rules. More
OversecuredEnterprise vulnerability scanner for Android and iOS apps, it offers app owners and developers the ability to secure each new version of a mobile app by integrating Oversecured into the development process. Not free
AppSweep by GuardsquareFree, fast Android application security testing for developers
KoodousPerforms static/dynamic malware analysis over a vast repository of Android samples and checks them against public and private Yara rules
Immuniweb. Does an "OWASP Mobile Top 10 Test", "Mobile App Privacy Check" and an application permissions test. The free tier is 4 tests per day incl. report after registration

android-security-awesome / Tools / Static Analysis Tools

Androwarn485over 6 years agodetect and warn the user about potential malicious behaviors developed by an Android application
ApkAnalyser1,019about 3 years ago
APKInspector833over 13 years ago
Droid Intent Data Flow Analysis for Information Leakage
DroidLegacy
FlowDroid
Android Decompiler– not free
PSCoutA tool that extracts the permission specification from the Android OS source code using static analysis
Amandroid
SmaliSCA317almost 7 years agoSmali Static Code Analysis
CFGScanDroid59over 11 years agoScans and compares CFG against CFG of malicious applications
Madrolyzer102over 11 years agoextracts actionable data like C&C, phone number etc
SPARTAverifies (proves) that an app satisfies an information-flow security policy; built on the
ConDroid56over 10 years agoPerforms a combination of symbolic + concrete execution of the app
DroidRA50over 6 years ago
RiskInDroid141almost 2 years agoA tool for calculating the risk of Android apps based on their permissions, with an online demo available
SUPER421about 6 years agoSecure, Unified, Powerful and Extensible Rust Android Analyzer
ClassyShark7,530over 3 years agoStandalone binary inspection tool that can browse any Android executable and show important info
StaCoAn830over 5 years agoCross-platform tool that aids developers, bug-bounty hunters, and ethical hackers in performing static code analysis on mobile applications. This tool was created with a big focus on usability and graphical guidance in the user interface
JAADAS349over 9 years agoJoint intraprocedural and interprocedural program analysis tool to find vulnerabilities in Android apps, built on Soot and Scala
Quark-Engine1,342almost 2 years agoAn Obfuscation-Neglect Android Malware Scoring System
One Step Decompiler252over 5 years agoAndroid APK Decompilation for the Lazy
APKLeaks4,989almost 2 years agoScanning APK file for URIs, endpoints & secrets
Mobile Audit206almost 2 years agoWeb application for performing Static Analysis and detecting malware in Android APKs

android-security-awesome / Tools / App Vulnerability Scanners

QARK3,210over 2 years agoQARK by LinkedIn is for app developers to scan apps for security issues
AndroBugs1,147over 7 years ago
Nogotofail2,941almost 4 years ago

android-security-awesome / Tools / Dynamic Analysis Tools

Android DBI frameowork
Androl4b1,110over 3 years agoA Virtual Machine For Assessing Android applications, Reverse Engineering and Malware Analysis
House1,400over 5 years agoHouse: A runtime mobile application analysis toolkit with a Web GUI, powered by Frida, written in Python
Mobile-Security-Framework MobSF17,691almost 2 years agoMobile Security Framework is an intelligent, all-in-one open-source mobile application (Android/iOS) automated pen-testing framework capable of performing static, dynamic analysis and web API testing
AppUse– custom build for penetration testing
Droidbox761over 3 years ago
Drozer3,978almost 2 years ago
Xposedequivalent of doing Stub-based code injection but without any modifications to the binary
Inspeckage2,827about 6 years agoAndroid Package Inspector - dynamic analysis with API hooks, start unexported activities, and more. (Xposed Module)
Android Hooker408about 10 years agoDynamic Java code instrumentation (requires the Substrate Framework)
ProbeDroid197almost 8 years agoDynamic Java code instrumentation
DECAF808almost 2 years agoDynamic Executable Code Analysis Framework based on QEMU (DroidScope is now an extension to DECAF)
CuckooDroid580almost 6 years agoAndroid extension for Cuckoo sandbox
Mem66over 11 years agoMemory analysis of Android (root required)
Crowdroid– unable to find the actual tool
AuditdAndroid45over 13 years ago– android port of auditd, not under active development anymore
Android Security Evaluation Frameworknot under active development anymore
Aurasium38over 11 years ago– Practical security policy enforcement for Android apps via bytecode rewriting and in-place reference monitor
Android Linux Kernel modules206about 12 years ago
StaDynA23over 3 years agoa system supporting security app analysis in the presence of dynamic code update features (dynamic class loading and reflection). This tool combines static and dynamic analysis of Android applications in order to reveal the hidden/updated behavior and extend static analysis results with this information
DroidAnalytics29over 11 years agoincomplete
Vezir Project103over 10 years agoVirtual Machine for Mobile Application Pentesting and Mobile Malware Analysis
MARA630about 7 years agoMobile Application Reverse Engineering and Analysis Framework
Taintdroidrequires AOSP compilation
ARTista flexible open-source instrumentation and hybrid analysis framework for Android apps and Android's Java middleware. It is based on the Android Runtime's (ART) compiler and modifies code during on-device compilation
Android Malware Sandbox281almost 4 years ago
AndroPyTool356almost 4 years agoa tool for extracting static and dynamic features from Android APKs. It combines different well-known Android app analysis tools such as DroidBox, FlowDroid, Strace, AndroGuard, or VirusTotal analysis
Runtime Mobile Security (RMS)2,649almost 2 years agois a powerful web interface that helps you to manipulate Android and iOS Apps at Runtime
PAPIMonitor51about 2 years ago– PAPIMonitor (Python API Monitor for Android apps) is a Python tool based on Frida for monitoring user-select APIs during the app execution
Android_application_analyzer153over 2 years agoThe tool is used to analyze the content of the Android application in local storage
Decompiler.comOnline APK and Java decompiler
friTap296almost 2 years ago- Intercept SSL/TLS connections with Frida; Allows TLS key extraction and decryption of TLS payload as PCAP on Android in real-time

android-security-awesome / Tools / Reverse Engineering

Smali/Baksmali6,364over 2 years ago– apk decompilation
emacs syntax coloring for smali files33over 7 years ago
vim syntax coloring for smali files
AndBug595about 10 years ago
Androguard5,324almost 2 years ago– powerful, integrates well with other tools
Apktool– really useful for compilation/decompilation (uses smali)
Android Framework for Exploitation189almost 11 years ago
Bypass signature and permission checks for IPCs83almost 13 years ago
Android OpenDebug129almost 13 years ago– make any application on the device debuggable (using cydia substrate)
Dex2Jar12,403about 2 years agodex to jar converter
Enjarify2,730almost 7 years agodex to jar converter from Google
Dedexer
Fino106almost 12 years ago
Fridainject javascript to explore applications and a for it
Indroid– thread injection kit
IntentSniffer
Introspy467over 12 years ago
JadJava decompiler
JD-GUI14,177about 2 years agoJava decompiler
CFRJava decompiler
Krakatau2,003almost 2 years agoJava decompiler
FernFlower3,514almost 2 years agoJava decompiler
Redexer164over 5 years ago– apk manipulation
Simplify Android deobfuscator4,471over 4 years ago
Bytecode viewer14,733almost 2 years ago
Radare220,862almost 2 years ago
Jadx42,178almost 2 years ago
Dwarf1,281over 2 years agoGUI for reverse engineering
Andromeda702over 6 years agoAnother basic command-line reverse engineering tool
apk-mitm4,003about 2 years agoA CLI application that prepares Android APK files for HTTPS inspection
Noia113almost 6 years agoSimple Android application sandbox file browser tool
Obfuscapk1,126about 2 years agoObfuscapk is a modular Python tool for obfuscating Android apps without needing their source code
ARMANDroid13almost 6 years agoARMAND (Anti-Repackaging through Multi-patternAnti-tampering based on Native Detection) is a novel anti-tampering protection scheme that embeds logic bombs and AT detection nodes directly in the apk file without needing their source code
MVT (Mobile Verification Toolkit)10,512almost 2 years agoa collection of utilities to simplify and automate the process of gathering forensic traces helpful to identify a potential compromise of Android and iOS devices
Dexmod52over 2 years agotool to exemplify patching Dalvik bytecode in a DEX (Dalvik Executable) file, and assist in the static analysis of Android applications

android-security-awesome / Tools / Fuzz Testing

Radamsa Fuzzer65almost 7 years ago
Honggfuzz3,093almost 2 years ago
An Android port of the Melkor ELF fuzzer60about 12 years ago
Media Fuzzing Framework for Android332over 10 years ago
AndroFuzz39about 12 years ago
QuarksLab's Android Fuzzing109over 3 years ago

android-security-awesome / Tools / App Repackaging Detectors

FSquaDRA71over 3 years agoa tool for detecting repackaged Android applications based on app resources hash comparison

android-security-awesome / Tools / Market Crawlers

Google Play crawler (Java)569about 3 years ago
Google Play crawler (Python)880over 9 years ago
Google Play crawler (Node)270over 5 years agoget app details and download apps from the official Google Play Store
Aptoide downloader (Node)25about 11 years agodownload apps from Aptoide third-party Android market
Appland downloader (Node)16about 11 years agodownload apps from Appland third-party Android market
PlaystoreDownloader1,140about 2 years agoPlaystoreDownloader is a tool for downloading Android applications directly from the Google Play Store. After an initial (one-time) configuration, applications can be downloaded by specifying their package name
APK DownloaderOnline Service to download APK from Playstore for specific Android Device Configuration

android-security-awesome / Tools / Misc Tools

smalihook
AXMLPrinter2to convert binary XML files to human-readable XML files
adb autocomplete252over 3 years ago
mitmproxy37,148almost 2 years ago
dockerfile/androguard41almost 7 years ago
Android Vulnerability Test Suite1,020about 7 years agoandroid-vts scans a device for set of vulnerabilities
AppMon1,569over 3 years agoAppMon is an automated framework for monitoring and tampering with system API calls of native macOS, iOS, and Android apps. It is based on Frida
Internal Blue694about 2 years agoBluetooth experimentation framework based on Reverse Engineering of Broadcom Bluetooth Controllers
Android Mobile Device Hardening202over 3 years agoAMDH scans and hardens the device's settings and lists harmful installed Apps based on permissions

android-security-awesome / Tools / Vulnerable Applications for practice

Damn Insecure Vulnerable Application (DIVA)974over 3 years ago
Vuldroid62about 5 years ago
ExploitMe Android Labs
GoatDroid239about 12 years ago
Android InsecureBank1,268over 2 years ago
Insecureshop234over 4 years ago
Oversecured Vulnerable Android App (OVAA)662about 2 years ago

android-security-awesome / Academic/Research/Publications/Books / Research Papers

Exploit Database
Android security-related presentations167about 5 years ago
A good collection of static analysis papers

android-security-awesome / Academic/Research/Publications/Books / Books

SEI CERT Android Secure Coding Standard

android-security-awesome / Academic/Research/Publications/Books / Others

OWASP Mobile Security Testing Guide Manual11,816almost 2 years ago
doridori/Android-Security-Reference923about 2 years ago
android app security checklist855about 4 years ago
Mobile App Pentest Cheat Sheet4,609over 2 years ago
Android Reverse Engineering 101 by Daniele Altomare (Web Archive link)

android-security-awesome / Exploits/Vulnerabilities/Bugs / List

Android Security Bulletins
Android's reported security vulnerabilities
AOSP - Issue tracker
OWASP Mobile Top 10 2016
Exploit Databaseclick search
Vulnerability Google Doc
Google Android Security Team’s Classifications for Potentially Harmful Applications (Malware)

android-security-awesome / Exploits/Vulnerabilities/Bugs / Malware

androguard - Database Android Malware wiki
Android Malware Github repo1,072over 6 years ago
Android Malware Genome Projectcontains 1260 malware samples categorized into 49 different malware families, free for research purposes
Contagio Mobile Malware Mini Dump
Drebin
Hudson RockFree cybercrime intelligence toolset that can indicate if a specific APK package was compromised in an Infostealer malware attack
Kharon Malware Dataset7 malware which have been reverse-engineered and documented
Android Adware and General Malware Dataset
AndroZooAndroZoo is a growing Android application collection from several sources, including the official Google Play app market

android-security-awesome / Exploits/Vulnerabilities/Bugs / Bounty Programs

Android Security Reward Program

android-security-awesome / Exploits/Vulnerabilities/Bugs / How to report Security issues

Android - reporting security issues
Android Reports and Resources1,496about 2 years agoList of Android Hackerone disclosed reports and other resources

Backlinks from these awesome lists:

More related projects: