ashishb/android-security-awesome

Tools

Online Analyzers

AppSweep by Guardsquare - Free, fast Android application security testing for developers

Tools

Online Analyzers

Oversecured - Enterprise vulnerability scanner for Android and iOS apps, it offers app owners and developers the ability to secure each new version of a mobile app by integrating Oversecured into the development process. Not free.

Tools

Vulnerable Applications for practice

Oversecured Vulnerable Android App (OVAA)stars277

Tools

Reverse Engineering

Decompiler.com - Online APK and Java decompiler

Tools

Online Analyzers

AMAaaS - Free Android Malware Analysis Service. A baremetal service features static and dynamic analysis for Android applications. A product of MalwarePot.

AppCritique - Upload your Android APKs and receive comprehensive free security assessments

Tools

Market Crawlers

APK Downloader Online Sevrice to download APK from Playstore for specific Android Device Configuration

Tools

Vulnerable Applications for practice

Insecureshopstars145

Tools

Dynamic Analysis Tools

Android_application_analyzerstars105 - The tool is used to analyze the content of the android application in local storage.

Android Malware Analysis Toolkit - (linux distro) Earlier it use to be an online analyzer

Android Reverse Engineering – ARE (android reverse engineering) not under active development anymore

ViaLab Community Edition

Mercury

Cobradroid – custom image for malware analysis

Tools

Reverse Engineering

MVT (Mobile Verification Toolkit)stars6.6k - a collection of utilities to simplify and automate the process of gathering forensic traces helpful to identify a potential compromise of Android and iOS devices

Procyon - Java decompiler

Smali viewer

ZjDroid, fork/mirror

Dare – .dex to .class converter

Tools

Online Analyzers

Approver - Approver is a fully automated security analysis and risk assessment platform for Android and iOS apps. Not free.

Tools

Dynamic Analysis Tools

PAPIMonitorstars24 – PAPIMonitor (Python API Monitor for Android apps) is a python tool based on Frida for monitoring user-select APIs during the app execution.

Tools

Reverse Engineering

Obfuscapkstars618 - Obfuscapk is a modular Python tool for obfuscating Android apps without needing their source code.

ARMANDroidstars4 - ARMAND (Anti-Repackaging through Multi-patternAnti-tampering based on Native Detection) is a novel anti-tampering protection scheme that embeds logic bombs and AT detection nodes directly in the apk file without needing their source code.

Tools

Market Crawlers

PlaystoreDownloaderstars867 - PlaystoreDownloader is a tool for downloading Android applications directly from the Google Play Store. After an initial (one-time) configuration, applications can be downloaded by specifying their package name.

Tools

Static Analysis Tools

Mobile Auditstars113 - Web application for performing Static Analysis and detecting malware in Android APKs.

Several tools from PSU

Tools

Online Analyzers

Pithus - Open-Source APK analyzer. Still in Beta for the moment and limited to static analysis for the moment. Possible to hunt malwares with Yara rules. More here.

Tools

Static Analysis Tools

APKLeaksstars2.8k - Scanning APK file for URIs, endpoints & secrets.

Tools

Static Analysis Tools

Quark-Enginestars792 - An Obfuscation-Neglect Android Malware Scoring System

One Step Decompilerstars179 - Android APK Decompilation for the Lazy

Tools

Misc Tools

Android Mobile Device Hardeningstars114 - AMDH scans and harden device's settings and list harmful installed Apps based on permissions.

Opcodes table for quick reference

APK-Downloader - seems dead now

Dalvik opcodes

Tools

Misc Tools

mitmproxystars25.8k

dockerfile/androguardstars33

Android Vulnerability Test Suitestars990 - android-vts scans a device for set of vulnerabilities

AppMonstars1.3k- AppMon is an automated framework for monitoring and tampering system API calls of native macOS, iOS and android apps. It is based on Frida.

Internal Bluestars465 - Bluetooth experimentation framework based on Reverse Engineering of Broadcom Bluetooth Controllers

Android Device Security Database - Database of security features of Android devices

Tools

Vulnerable Applications for practice

Damn Insecure Vulnerable Application (DIVA)stars697

Vuldroidstars35

ExploitMe Android Labs

GoatDroidstars223

Android InsecureBankstars920

Tools

Dynamic Analysis Tools

Housestars1.1k- House: A runtime mobile application analysis toolkit with a Web GUI, powered by Frida, written in Python.

Tools

Reverse Engineering

IntentSniffer

Tools

App Vulnerability Scanners

Devknox - IDE plugin to build secure Android apps. Not maintained anymore.

Tools

Dynamic Analysis Tools

Runtime Mobile Security (RMS)stars1.7k - is a powerful web interface that helps you to manipulate Android and iOS Apps at Runtime

Tools

Reverse Engineering

Noiastars82 - Simple Android application sandbox file browser tool

Academic/Research/Publications/Books

Others

Android Reverse Engineering 101 by Daniele Altomare (Web Archive link)

Tools

Online Analyzers

App Detonator - Detonate APK binary to provide source code level details including app author, signature, build and manifest information. 3 Analysis/day free quota.

BitBaan

Exploits/Vulnerabilities/Bugs

Malware

Kharon Malware Dataset - 7 malwares which have been reverse engineered and documented

Android Adware and General Malware Dataset

Android PRAGuard Dataset - The dataset contains 10479 samples, obtained by obfuscating the MalGenome and the Contagio Minidump datasets with seven different obfuscation techniques.

AndroZoo - AndroZoo is a growing collection of Android Applications collected from several sources, including the official Google Play app market.

Tools

Dynamic Analysis Tools

AndroPyToolstars233 - a tool for extracting static and dynamic features from Android APKs. It combines different well-known Android apps analysis tools such as DroidBox, FlowDroid, Strace, AndroGuard or VirusTotal analysis.

Tools

Dynamic Analysis Tools

Droidboxstars617

Tools

Dynamic Analysis Tools

Android Malware Sandboxstars202

Tools

Online Analyzers

NVISO ApkScan - sunsetting on Oct 31, 2019

Tools

Reverse Engineering

apk-mitmstars1.5k - A CLI application that prepares Android APK files for HTTPS inspection

Tools

Dynamic Analysis Tools

ARTist - a flexible open source instrumentation and hybrid analysis framework for Android apps and Android's java middleware. It is based on the Android Runtime's (ART) compiler and modifies code during on-device compilation.

Tools

Reverse Engineering

Simplify Android deobfuscatorstars3.9k

Andromedastars651 - Another basic command-line reverse engineering tool

Tools

Dynamic Analysis Tools

Android DBI frameowork

Androl4bstars951- A Virtual Machine For Assessing Android applications, Reverse Engineering and Malware Analysis

Tools

Market Crawlers

Google play crawler (Node)stars263 - get app details and download apps from official Google Play Store.

Academic/Research/Publications/Books

Research Papers

Exploit Database

Academic/Research/Publications/Books

Others

OWASP Mobile Security Testing Guide Manualstars8.5k

Tools

Online Analyzers

Mobile Malware Sandbox

IBM Security AppScan Mobile Analyzer - not free

Tools

Static Analysis Tools

Androwarnstars383 - detect and warn the user about potential malicious behaviours developed by an Android application.

Tools

Online Analyzers

Visual Threat - no longer an Android app analyzer

Tools

Reverse Engineering

Dedexer

Academic/Research/Publications/Books

Others

Mobile Security Reading Room - A reading room which contains well categorised technical reading material about mobile penetration testing, mobile malware, mobile forensics and all kind of mobile security related topics

Tools

Online Analyzers

Tracedroid

CopperDroid

Tools

Reverse Engineering

Dwarfstars1k - GUI for reverse engineering

Tools

Static Analysis Tools

JAADASstars320 - Joint intraprocedure and interprocedure program analysis tool to find vulnerabilities in Android apps, built on Soot and Scala

Exploits/Vulnerabilities/Bugs

Malware

Drebin

Admire

Tools

Static Analysis Tools

ConDroidstars45 - Performs a combination of symbolic + concrete execution of the app

Tools

Dynamic Analysis Tools

Appie - Appie is a software package that has been pre-configured to function as an Android Pentesting Environment. It is completely portable and can be carried on USB stick or smartphone. This is a one stop answer for all the tools needed in Android Application Security Assessment and an awesome alternative to existing virtual machines.

Tools

Reverse Engineering

Jadxstars28.8k

Academic/Research/Publications/Books

Others

doridori/Android-Security-Referencestars748

android app security checkliststars652

Mobile App Pentest Cheat Sheetstars3.1k

Tools

Dynamic Analysis Tools

Taintdroid - requires AOSP compilation

Tools

Online Analyzers

habo - 10/day

SandDroid

Stowaway

Anubis

Mobile app insight

Mobile-Sandbox

Ijiami

Comdroid

Android Sandbox

Foresafe

Dexter

MobiSec Eacus

Fireeye- max 60MB 15/day

Tools

Online Analyzers

Appknox - not free

AVC UnDroid

Virustotal - max 128MB

Fraunhofer App-ray - not free

NowSecure Lab Automated - Enterprise tool for mobile app security testing both Android and iOS mobile apps. Lab Automated features dynamic and static analysis on real devices in the cloud to return results in minutes. Not free

Tools

Market Crawlers

Apkpure - Online apk downloader. Provides also an own app for downloading.

Tools

Static Analysis Tools

StaCoAnstars748 - Crossplatform tool which aids developers, bugbounty hunters and ethical hackers performing static code analysis on mobile applications. This tool was created with a big focus on usability and graphical guidance in the user interface.

Exploits/Vulnerabilities/Bugs

How to report Security issues

Android Reports and Resourcesstars865 - List of Android Hackerone disclosed reports and other resources

Tools

Static Analysis Tools

ApkAnalyserstars955

APKInspectorstars756

Droid Intent Data Flow Analysis for Information Leakage

DroidLegacy

Smali CFG generatorstars124

FlowDroid

Android Decompiler – not free

PSCout - A tool that extracts the permission specification from the Android OS source code using static analysis

Amandroid

SmaliSCAstars294 - Smali Static Code Analysis

CFGScanDroidstars44 - Scans and compares CFG against CFG of malicious applications

Madrolyzerstars93 - extracts actionable data like C&C, phone number etc.

SPARTA - verifies (proves) that an app satisfies an information-flow security policy; built on the Checker Framework

DroidRAstars42

RiskInDroidstars64 - A tool for calculating the risk of Android apps based on their permissions, with online demo available.

SUPERstars372 - Secure, Unified, Powerful and Extensible Rust Android Analyzer

ClassySharkstars6.9k - Standalone binary inspection tool which can browse any Android executable and show important infos.

Tools

App Vulnerability Scanners

AndroBugsstars939

Nogotofailstars2.8k

Tools

Dynamic Analysis Tools

Mobile-Security-Framework MobSFstars10.4k - Mobile Security Framework is an intelligent, all-in-one open source mobile application (Android/iOS) automated pen-testing framework capable of performing static, dynamic analysis and web API testing.

AppUse – custom build for pentesting

Drozerstars2.7k

Xposed - equivalent of doing Stub based code injection but without any modifications to the binary

Inspeckagestars2.3k - Android Package Inspector - dynamic analysis with api hooks, start unexported activities and more. (Xposed Module)

Android Hookerstars389 - Dynamic Java code instrumentation (requires the Substrate Framework)

ProbeDroidstars186 - Dynamic Java code instrumentation

Android Tamer - Virtual / Live Platform for Android Security Professionals

DECAFstars677 - Dynamic Executable Code Analysis Framework based on QEMU (DroidScope is now an extension to DECAF)

CuckooDroidstars529 - Android extension for Cuckoo sandbox

Memstars55 - Memory analysis of Android (root required)

Crowdroid – unable to find the actual tool

AuditdAndroidstars43 – android port of auditd, not under active development anymore

Android Security Evaluation Framework - not under active development anymore

Aurasiumstars36 – Practical security policy enforcement for Android apps via bytecode rewriting and in-place reference monitor.

Android Linux Kernel modulesstars172

StaDynAstars18 - a system supporting security app analysis in the presence of dynamic code update features (dynamic class loading and reflection). This tool combines static and dynamic analysis of Android applications in order to reveal the hidden/updated behavior and extend static analysis results with this information.

DroidAnalyticsstars27 - incomplete

Vezir Projectstars85 - Virtual Machine for Mobile Application Pentesting and Mobile Malware Analysis

MARAstars527 - Mobile Application Reverse engineering and Analysis Framework

Tools

Reverse Engineering

emacs syntax coloring for smali filesstars31

vim syntax coloring for smali files

AndBugstars578

Androguardstars3.8k – powerful, integrates well with other tools

Apktool – really useful for compilation/decompilation (uses smali)

Android Framework for Exploitationstars173

Bypass signature and permission checks for IPCsstars73

Android OpenDebugstars121 – make any application on device debuggable (using cydia substrate).

Dex2Jarstars9.4k - dex to jar converter

Enjarifystars2.6k - dex to jar converter from Google

Finostars96

Frida - inject javascript to explore applications and a GUI toolstars152 for it

Indroid – thread injection kit

Introspystars442

Jad - Java decompiler

JD-GUIstars10.8k - Java decompiler

CFR - Java decompiler

Krakataustars1.5k - Java decompiler

FernFlowerstars2.4k - Java decompiler

Redexerstars141 – apk manipulation

Bytecode viewerstars12.7k

Radare2stars15.6k

Tools

Fuzz Testing

Radamsa Fuzzerstars60

Honggfuzzstars2.4k

An Android port of the melkor ELF fuzzerstars57

Media Fuzzing Framework for Androidstars317

AndroFuzzstars32

Tools

Market Crawlers

Google play crawler (Python)stars838

Aptoide downloader (Node)stars19 - download apps from Aptoide third-party Android market

Appland downloader (Node)stars14 - download apps from Appland third-party Android market

Tools

Misc Tools

AXMLPrinter2 - to convert binary XML files to human-readable XML files

adb autocompletestars222

Academic/Research/Publications/Books

Research Papers

Android security related presentationsstars148

A good collection of static analysis papers

Exploits/Vulnerabilities/Bugs

List

Android's reported security vulnerabilities

Android Devices Security Patch Status

AOSP - Issue tracker

OWASP Mobile Top 10 2016

Exploit Database - click search

Vulnerability Google Doc

Google Android Security Team’s Classifications for Potentially Harmful Applications (Malware)

Exploits/Vulnerabilities/Bugs

Malware

Android Malware Github repostars770

Android Malware Genome Project - contains 1260 malware samples categorized into 49 different malware families, free for research purpose.

Contagio Mobile Malware Mini Dump

VirusTotal Malware Intelligence Service - powered by VirusTotal, not free

Exploits/Vulnerabilities/Bugs

Malware

androguard - Database Android Malwares wiki

Exploits/Vulnerabilities/Bugs

List

Android Security Bulletins

Academic/Research/Publications/Books

Books

SEI CERT Android Secure Coding Standard

Exploits/Vulnerabilities/Bugs

Bounty Programs

Android Security Reward Program

Exploits/Vulnerabilities/Bugs

How to report Security issues

Android - reporting security issues

Tools

Reverse Engineering

Smali/Baksmalistars5.3k – apk decompilation

Tools

Fuzz Testing

IntentFuzzer

Tools

App Vulnerability Scanners

QARKstars2.7k - QARK by LinkedIn is for app developers to scan app for security issues

Tools

Market Crawlers

Google play crawler (Java)stars505

Tools

App Repackaging Detectors

FSquaDRAstars65 - a tool for detection of repackaged Android applications based on app resources hash comparison.

Tools

Online Analyzers

AndroTotal

Tools

Misc Tools

smalihook