662 lines
33 KiB
HTML
662 lines
33 KiB
HTML
<h1 id="android-security-awesome-awesome">android-security-awesome <img
|
||
src="https://cdn.rawgit.com/sindresorhus/awesome/d7305f38d29fed78fa85652e3a63e154dd8e8829/media/badge.svg"
|
||
alt="Awesome" /></h1>
|
||
<p><a
|
||
href="https://github.com/ashishb/android-security-awesome/actions/workflows/validate-links.yml"><img
|
||
src="https://github.com/ashishb/android-security-awesome/actions/workflows/validate-links.yml/badge.svg"
|
||
alt="Link Liveness Checker" /></a></p>
|
||
<p><a
|
||
href="https://github.com/ashishb/android-security-awesome/actions/workflows/lint-shell-script.yaml"><img
|
||
src="https://github.com/ashishb/android-security-awesome/actions/workflows/lint-shell-script.yaml/badge.svg"
|
||
alt="Lint Shell scripts" /></a> <a
|
||
href="https://github.com/ashishb/android-security-awesome/actions/workflows/lint-markdown.yaml"><img
|
||
src="https://github.com/ashishb/android-security-awesome/actions/workflows/lint-markdown.yaml/badge.svg"
|
||
alt="Lint Markdown" /></a> <a
|
||
href="https://github.com/ashishb/android-security-awesome/actions/workflows/lint-yaml.yaml"><img
|
||
src="https://github.com/ashishb/android-security-awesome/actions/workflows/lint-yaml.yaml/badge.svg"
|
||
alt="Lint YAML" /></a> <a
|
||
href="https://github.com/ashishb/android-security-awesome/actions/workflows/lint-github-actions.yaml"><img
|
||
src="https://github.com/ashishb/android-security-awesome/actions/workflows/lint-github-actions.yaml/badge.svg"
|
||
alt="Lint GitHub Actions" /></a> <img
|
||
src="https://img.shields.io/github/contributors/ashishb/android-security-awesome"
|
||
alt="GitHub contributors" /></p>
|
||
<p>A collection of Android security-related resources.</p>
|
||
<ol type="1">
|
||
<li><a href="#tools">Tools</a></li>
|
||
<li><a href="#academic">Academic/Research/Publications/Books</a></li>
|
||
<li><a href="#exploits">Exploits/Vulnerabilities/Bugs</a></li>
|
||
</ol>
|
||
<h2 id="tools">Tools</h2>
|
||
<h3 id="online-analyzers">Online Analyzers</h3>
|
||
<ol type="1">
|
||
<li><a href="http://andrototal.org/">AndroTotal</a></li>
|
||
<li><a href="https://www.appknox.com/">Appknox</a> - not free</li>
|
||
<li><a href="https://www.virustotal.com/">Virustotal</a> - max
|
||
128MB</li>
|
||
<li><a href="http://app-ray.co/">Fraunhofer App-ray</a> - not free</li>
|
||
<li><a
|
||
href="https://www.nowsecure.com/blog/2016/09/19/announcing-nowsecure-lab-automated/">NowSecure
|
||
Lab Automated</a> - Enterprise tool for mobile app security testing both
|
||
Android and iOS mobile apps. Lab Automated features dynamic and static
|
||
analysis on real devices in the cloud to return results in minutes. Not
|
||
free</li>
|
||
<li><a href="https://appdetonator.run/">App Detonator</a> - Detonate APK
|
||
binary to provide source code level details, including app author,
|
||
signature, build, and manifest information. 3 Analysis/day free
|
||
quota.</li>
|
||
<li><a href="https://beta.pithus.org/">Pithus</a> - Open-Source APK
|
||
analyzer. Still in Beta and limited to static analysis for the moment.
|
||
It is possible to hunt malware with Yara rules. More <a
|
||
href="https://beta.pithus.org/about/">here</a>.</li>
|
||
<li><a href="https://oversecured.com/">Oversecured</a> - Enterprise
|
||
vulnerability scanner for Android and iOS apps; it offers app owners and
|
||
developers the ability to secure each new version of a mobile app by
|
||
integrating Oversecured into the development process. Not free.</li>
|
||
<li><a href="https://appsweep.guardsquare.com/">AppSweep by
|
||
Guardsquare</a> - Free, fast Android application security testing for
|
||
developers</li>
|
||
<li><a href="https://koodous.com">Koodous</a> - Performs static/dynamic
|
||
malware analysis over a vast repository of Android samples and checks
|
||
them against public and private Yara rules.</li>
|
||
<li><a href="https://www.immuniweb.com/mobile/">Immuniweb</a>. Does an
|
||
“OWASP Mobile Top 10 Test”, “Mobile App Privacy Check”, and an
|
||
application permissions test. The free tier is 4 tests per day,
|
||
including report after registration</li>
|
||
<li><del><a href="https://malab.bitbaan.com/">BitBaan</a></del></li>
|
||
<li><del><a href="http://undroid.av-comparatives.info/">AVC
|
||
UnDroid</a></del></li>
|
||
<li><del><a href="https://amaaas.com">AMAaaS</a> - Free Android Malware
|
||
Analysis Service. A bare-metal service features static and dynamic
|
||
analysis for Android applications. A product of <a
|
||
href="https://malwarepot.com/index.php/AMAaaS">MalwarePot</a></del>.</li>
|
||
<li><del><a href="https://appcritique.boozallen.com">AppCritique</a> -
|
||
Upload your Android APKs and receive comprehensive free security
|
||
assessments</del></li>
|
||
<li><del><a href="https://apkscan.nviso.be/">NVISO ApkScan</a> -
|
||
sunsetting on Oct 31, 2019</del></li>
|
||
<li><del><a
|
||
href="http://www.mobilemalware.com.br/analysis/index_en.php">Mobile
|
||
Malware Sandbox</a></del></li>
|
||
<li><del><a href="https://appscan.bluemix.net/mobileAnalyzer">IBM
|
||
Security AppScan Mobile Analyzer</a> - not free</del></li>
|
||
<li><del><a href="https://www.visualthreat.com/">Visual Threat</a> - no
|
||
longer an Android app analyzer</del></li>
|
||
<li><del><a
|
||
href="http://tracedroid.few.vu.nl/">Tracedroid</a></del></li>
|
||
<li><del><a href="https://habo.qq.com/">habo</a> - 10/day</del></li>
|
||
<li><del><a
|
||
href="http://copperdroid.isg.rhul.ac.uk/copperdroid/">CopperDroid</a></del></li>
|
||
<li><del><a
|
||
href="http://sanddroid.xjtu.edu.cn/">SandDroid</a></del></li>
|
||
<li><del><a
|
||
href="http://www.android-permissions.org/">Stowaway</a></del></li>
|
||
<li><del><a href="http://anubis.iseclab.org/">Anubis</a></del></li>
|
||
<li><del><a href="http://www.mobile-app-insight.org">Mobile app
|
||
insight</a></del></li>
|
||
<li><del><a
|
||
href="http://mobile-sandbox.com">Mobile-Sandbox</a></del></li>
|
||
<li><del><a href="http://safe.ijiami.cn/">Ijiami</a></del></li>
|
||
<li><del><a href="http://www.comdroid.org/">Comdroid</a></del></li>
|
||
<li><del><a href="http://www.androidsandbox.net/">Android
|
||
Sandbox</a></del></li>
|
||
<li><del><a href="http://www.foresafe.com/scan">Foresafe</a></del></li>
|
||
<li><del><a href="https://dexter.dexlabs.org/">Dexter</a></del></li>
|
||
<li><del><a href="http://www.mobiseclab.org/eacus.jsp">MobiSec
|
||
Eacus</a></del></li>
|
||
<li><del><a href="https://fireeye.ijinshan.com/">Fireeye</a>- max 60MB
|
||
15/day</del></li>
|
||
<li><del><a href="https://approver.talos-sec.com/">approver</a> -
|
||
Approver is a fully automated security analysis and risk assessment
|
||
platform for Android and iOS apps. Not free.</del></li>
|
||
</ol>
|
||
<h3 id="static-analysis-tools">Static Analysis Tools</h3>
|
||
<ol type="1">
|
||
<li><a href="https://github.com/maaaaz/androwarn/">Androwarn</a> -
|
||
detect and warn the user about potential malicious behaviors developed
|
||
by an Android application.</li>
|
||
<li><a
|
||
href="https://github.com/sonyxperiadev/ApkAnalyser">ApkAnalyser</a></li>
|
||
<li><a
|
||
href="https://github.com/honeynet/apkinspector/">APKInspector</a></li>
|
||
<li><a href="https://insights.sei.cmu.edu/library/didfail/">Droid Intent
|
||
Data Flow Analysis for Information Leakage</a></li>
|
||
<li><a href="https://bitbucket.org/srl/droidlegacy">DroidLegacy</a></li>
|
||
<li><a
|
||
href="https://blogs.uni-paderborn.de/sse/tools/flowdroid/">FlowDroid</a></li>
|
||
<li><a href="https://www.pnfsoftware.com/">Android Decompiler</a> – not
|
||
free</li>
|
||
<li><a href="https://security.csl.toronto.edu/pscout/">PSCout</a> - A
|
||
tool that extracts the permission specification from the Android OS
|
||
source code using static analysis</li>
|
||
<li><a href="http://amandroid.sireum.org/">Amandroid</a></li>
|
||
<li><a href="https://github.com/dorneanu/smalisca">SmaliSCA</a> - Smali
|
||
Static Code Analysis</li>
|
||
<li><a href="https://github.com/douggard/CFGScanDroid">CFGScanDroid</a>
|
||
- Scans and compares the CFG against the CFG of malicious
|
||
applications</li>
|
||
<li><a href="https://github.com/maldroid/maldrolyzer">Madrolyzer</a> -
|
||
extracts actionable data like C&C, phone number etc.</li>
|
||
<li><a href="https://github.com/JulianSchuette/ConDroid">ConDroid</a> -
|
||
Performs a combination of symbolic + concrete execution of the app</li>
|
||
<li><a
|
||
href="https://github.com/serval-snt-uni-lu/DroidRA">DroidRA</a></li>
|
||
<li><a
|
||
href="https://github.com/ClaudiuGeorgiu/RiskInDroid">RiskInDroid</a> - A
|
||
tool for calculating the risk of Android apps based on their
|
||
permissions, with an online demo available.</li>
|
||
<li><a href="https://github.com/SUPERAndroidAnalyzer/super">SUPER</a> -
|
||
Secure, Unified, Powerful, and Extensible Rust Android Analyzer</li>
|
||
<li><a
|
||
href="https://github.com/google/android-classyshark">ClassyShark</a> - A
|
||
Standalone binary inspection tool that can browse any Android executable
|
||
and show important info.</li>
|
||
<li><a href="https://github.com/vincentcox/StaCoAn">StaCoAn</a> -
|
||
Cross-platform tool that aids developers, bug-bounty hunters, and
|
||
ethical hackers in performing static code analysis on mobile
|
||
applications. This tool was created with a big focus on usability and
|
||
graphical guidance in the user interface.</li>
|
||
<li><a href="https://github.com/flankerhqd/JAADAS">JAADAS</a> - Joint
|
||
intraprocedural and interprocedural program analysis tool to find
|
||
vulnerabilities in Android apps, built on Soot and Scala</li>
|
||
<li><a
|
||
href="https://github.com/quark-engine/quark-engine">Quark-Engine</a> -
|
||
An Obfuscation-Neglect Android Malware Scoring System</li>
|
||
<li><a href="https://github.com/b-mueller/apkx">One Step Decompiler</a>
|
||
- Android APK Decompilation for the Lazy</li>
|
||
<li><a href="https://github.com/dwisiswant0/apkleaks">APKLeaks</a> -
|
||
Scanning APK file for URIs, endpoints & secrets.</li>
|
||
<li><a href="https://github.com/mpast/mobileAudit">Mobile Audit</a> -
|
||
Web application for performing Static Analysis and detecting malware in
|
||
Android APKs.</li>
|
||
<li><del><a href="https://github.com/EugenioDelfa/Smali-CFGs">Smali CFG
|
||
generator</a></del></li>
|
||
<li><del><a href="http://siis.cse.psu.edu/tools.html">Several tools from
|
||
PSU</a></del></li>
|
||
<li><del><a href="https://www.cs.washington.edu/sparta">SPARTA</a> -
|
||
verifies (proves) that an app satisfies an information-flow security
|
||
policy; built on the <a
|
||
href="https://types.cs.washington.edu/checker-framework/">Checker
|
||
Framework</a></del></li>
|
||
</ol>
|
||
<h3 id="app-vulnerability-scanners">App Vulnerability Scanners</h3>
|
||
<ol type="1">
|
||
<li><a href="https://github.com/linkedin/qark/">QARK</a> - QARK by
|
||
LinkedIn is for app developers to scan apps for security issues</li>
|
||
<li><a
|
||
href="https://github.com/AndroBugs/AndroBugs_Framework">AndroBugs</a></li>
|
||
<li><a href="https://github.com/google/nogotofail">Nogotofail</a></li>
|
||
<li><del><a href="https://devknox.io/">Devknox</a> - IDE plugin to build
|
||
secure Android apps. Not maintained anymore.</del></li>
|
||
</ol>
|
||
<h3 id="dynamic-analysis-tools">Dynamic Analysis Tools</h3>
|
||
<ol type="1">
|
||
<li><a
|
||
href="http://www.mulliner.org/blog/blosxom.cgi/security/androiddbiv02.html">Android
|
||
DBI frameowork</a></li>
|
||
<li><a href="https://github.com/sh4hin/Androl4b">Androl4b</a>- A Virtual
|
||
Machine For Assessing Android applications, Reverse Engineering and
|
||
Malware Analysis</li>
|
||
<li><a href="https://github.com/nccgroup/house">House</a>- House: A
|
||
runtime mobile application analysis toolkit with a Web GUI, powered by
|
||
Frida, written in Python.</li>
|
||
<li><a
|
||
href="https://github.com/MobSF/Mobile-Security-Framework-MobSF">Mobile-Security-Framework
|
||
MobSF</a> - Mobile Security Framework is an intelligent, all-in-one
|
||
open-source mobile application (Android/iOS) automated pen-testing
|
||
framework capable of performing static, dynamic analysis and web API
|
||
testing.</li>
|
||
<li><a href="https://appsec-labs.com/AppUse/">AppUse</a> – custom build
|
||
for penetration testing</li>
|
||
<li><a href="https://github.com/pjlantz/droidbox">Droidbox</a></li>
|
||
<li><a href="https://github.com/mwrlabs/drozer">Drozer</a></li>
|
||
<li><a
|
||
href="https://forum.xda-developers.com/xposed/xposed-installer-versions-changelog-t2714053">Xposed</a>
|
||
- equivalent of doing Stub-based code injection but without any
|
||
modifications to the binary</li>
|
||
<li><a href="https://github.com/ac-pm/Inspeckage">Inspeckage</a> -
|
||
Android Package Inspector - dynamic analysis with API hooks, start
|
||
unexported activities, and more. (Xposed Module)</li>
|
||
<li><a href="https://github.com/AndroidHooker/hooker">Android Hooker</a>
|
||
- Dynamic Java code instrumentation (requires the Substrate
|
||
Framework)</li>
|
||
<li><a href="https://github.com/ZSShen/ProbeDroid">ProbeDroid</a> -
|
||
Dynamic Java code instrumentation</li>
|
||
<li><a href="https://github.com/sycurelab/DECAF">DECAF</a> - Dynamic
|
||
Executable Code Analysis Framework based on QEMU (DroidScope is now an
|
||
extension to DECAF)</li>
|
||
<li><a href="https://github.com/idanr1986/cuckoo-droid">CuckooDroid</a>
|
||
- Android extension for Cuckoo sandbox</li>
|
||
<li><a href="https://github.com/MobileForensicsResearch/mem">Mem</a> -
|
||
Memory analysis of Android (root required)</li>
|
||
<li><a
|
||
href="http://www.ida.liu.se/labs/rtslab/publications/2011/spsm11-burguera.pdf">Crowdroid</a>
|
||
– unable to find the actual tool</li>
|
||
<li><a
|
||
href="https://github.com/nwhusted/AuditdAndroid">AuditdAndroid</a> –
|
||
Android port of auditd, not under active development anymore</li>
|
||
<li><a href="https://code.google.com/p/asef/">Android Security
|
||
Evaluation Framework</a> - not under active development anymore</li>
|
||
<li><a href="https://github.com/xurubin/aurasium">Aurasium</a> –
|
||
Practical security policy enforcement for Android apps via bytecode
|
||
rewriting and in-place reference monitoring.</li>
|
||
<li><a href="https://github.com/strazzere/android-lkms">Android Linux
|
||
Kernel modules</a></li>
|
||
<li><a href="https://github.com/zyrikby/StaDynA">StaDynA</a> - a system
|
||
supporting security app analysis in the presence of dynamic code update
|
||
features (dynamic class loading and reflection). This tool combines
|
||
static and dynamic analysis of Android applications in order to reveal
|
||
the hidden/updated behavior and extend static analysis results with this
|
||
information.</li>
|
||
<li><a
|
||
href="https://github.com/zhengmin1989/DroidAnalytics">DroidAnalytics</a>
|
||
- incomplete</li>
|
||
<li><a href="https://github.com/oguzhantopgul/Vezir-Project">Vezir
|
||
Project</a> - Virtual Machine for Mobile Application Pentesting and
|
||
Mobile Malware Analysis</li>
|
||
<li><a href="https://github.com/xtiankisutsa/MARA_Framework">MARA</a> -
|
||
Mobile Application Reverse Engineering and Analysis Framework</li>
|
||
<li><a href="http://appanalysis.org">Taintdroid</a> - requires AOSP
|
||
compilation</li>
|
||
<li><a href="https://artist.cispa.saarland">ARTist</a> - a flexible
|
||
open-source instrumentation and hybrid analysis framework for Android
|
||
apps and Android’s Java middleware. It is based on the Android Runtime’s
|
||
(ART) compiler and modifies code during on-device compilation.</li>
|
||
<li><a href="https://github.com/Areizen/Android-Malware-Sandbox">Android
|
||
Malware Sandbox</a></li>
|
||
<li><a href="https://github.com/alexMyG/AndroPyTool">AndroPyTool</a> - a
|
||
tool for extracting static and dynamic features from Android APKs. It
|
||
combines different well-known Android app analysis tools such as
|
||
DroidBox, FlowDroid, Strace, AndroGuard, or VirusTotal analysis.</li>
|
||
<li><a
|
||
href="https://github.com/m0bilesecurity/RMS-Runtime-Mobile-Security">Runtime
|
||
Mobile Security (RMS)</a> - is a powerful web interface that helps you
|
||
to manipulate Android and iOS Apps at Runtime</li>
|
||
<li><a href="https://github.com/Dado1513/PAPIMonitor">PAPIMonitor</a> –
|
||
PAPIMonitor (Python API Monitor for Android apps) is a Python tool based
|
||
on Frida for monitoring user-select APIs during the app execution.</li>
|
||
<li><a
|
||
href="https://github.com/NotSoSecure/android_application_analyzer">Android_application_analyzer</a>
|
||
- The tool is used to analyze the content of the Android application in
|
||
local storage.</li>
|
||
<li><a href="https://www.decompiler.com/">Decompiler.com</a> - Online
|
||
APK and Java decompiler</li>
|
||
<li><a href="https://github.com/fkie-cad/friTap">friTap</a>- Intercept
|
||
SSL/TLS connections with Frida; Allows TLS key extraction and decryption
|
||
of TLS payload as PCAP on Android in real-time.</li>
|
||
<li><a href="https://github.com/RaffaDNDM/HacknDroid">HacknDroid</a> - A
|
||
tool designed to automate various Mobile Application Penetration Testing
|
||
(MAPT) tasks and facilitate interaction with Android devices.</li>
|
||
<li><a href="https://github.com/mesquidar/adbsploit">adbsploit</a> -
|
||
tools for exploiting device via ADB</li>
|
||
<li><del><a href="https://manifestsecurity.com/appie/">Appie</a> - Appie
|
||
is a software package that has been pre-configured to function as an
|
||
Android Pentesting Environment. It is completely portable and can be
|
||
carried on a USB stick or smartphone. This is a one-stop answer for all
|
||
the tools needed in Android Application Security Assessment and an
|
||
awesome alternative to existing virtual machines.</del></li>
|
||
<li><del><a href="https://androidtamer.com/">Android Tamer</a> - Virtual
|
||
/ Live Platform for Android Security Professionals</del></li>
|
||
<li><del><a
|
||
href="http://www.mobilemalware.com.br/amat/download.html">Android
|
||
Malware Analysis Toolkit</a> - (Linux distro) Earlier, it used to be an
|
||
<a href="http://dunkelheit.com.br/amat/analysis/index_en.php">online
|
||
analyzer</a></del></li>
|
||
<li><del><a
|
||
href="https://redmine.honeynet.org/projects/are/wiki">Android Reverse
|
||
Engineering</a> – ARE (android reverse engineering) is not under active
|
||
development anymore</del></li>
|
||
<li><del><a
|
||
href="https://www.nowsecure.com/blog/2014/09/09/introducing-vialab-community-edition/">ViaLab
|
||
Community Edition</a></del></li>
|
||
<li><del><a
|
||
href="https://labs.mwrinfosecurity.com/tools/2012/03/16/mercury/">Mercury</a></del></li>
|
||
<li><del><a
|
||
href="https://thecobraden.com/projects/cobradroid/">Cobradroid</a> –
|
||
custom image for malware analysis</del></li>
|
||
</ol>
|
||
<h3 id="reverse-engineering">Reverse Engineering</h3>
|
||
<ol type="1">
|
||
<li><a href="https://github.com/JesusFreke/smali">Smali/Baksmali</a> –
|
||
apk decompilation</li>
|
||
<li><a href="https://github.com/strazzere/Emacs-Smali">emacs syntax
|
||
coloring for smali files</a></li>
|
||
<li><a href="http://codetastrophe.com/smali.vim">vim syntax coloring for
|
||
smali files</a></li>
|
||
<li><a href="https://github.com/swdunlop/AndBug">AndBug</a></li>
|
||
<li><a href="https://github.com/androguard/androguard">Androguard</a> –
|
||
powerful, integrates well with other tools</li>
|
||
<li><a href="https://ibotpeaches.github.io/Apktool/">Apktool</a> –
|
||
really useful for compilation/decompilation (uses smali)</li>
|
||
<li><a href="https://github.com/appknox/AFE">Android Framework for
|
||
Exploitation</a></li>
|
||
<li><a
|
||
href="https://github.com/iSECPartners/Android-KillPermAndSigChecks">Bypass
|
||
signature and permission checks for IPCs</a></li>
|
||
<li><a href="https://github.com/iSECPartners/Android-OpenDebug">Android
|
||
OpenDebug</a> – make any application on the device debuggable (using
|
||
cydia substrate).</li>
|
||
<li><a href="https://github.com/pxb1988/dex2jar">Dex2Jar</a> - dex to
|
||
jar converter</li>
|
||
<li><a href="https://github.com/google/enjarify">Enjarify</a> - dex to
|
||
jar converter from Google</li>
|
||
<li><a href="https://sourceforge.net/projects/dedexer/">Dedexer</a></li>
|
||
<li><a href="https://github.com/sysdream/fino">Fino</a></li>
|
||
<li><a href="https://www.frida.re/">Frida</a> - inject JavaScript to
|
||
explore applications and a <a
|
||
href="https://github.com/antojoseph/diff-gui">GUI tool</a> for it</li>
|
||
<li><a href="https://bitbucket.org/aseemjakhar/indroid">Indroid</a> –
|
||
thread injection kit</li>
|
||
<li><a
|
||
href="https://www.nccgroup.com/us/our-research/intent-sniffer/">IntentSniffer</a></li>
|
||
<li><a
|
||
href="https://github.com/iSECPartners/Introspy-Android">Introspy</a></li>
|
||
<li><a href="https://varaneckas.com/jad/">Jad</a> - Java decompiler</li>
|
||
<li><a href="https://github.com/java-decompiler/jd-gui">JD-GUI</a> -
|
||
Java decompiler</li>
|
||
<li><a href="http://www.benf.org/other/cfr/">CFR</a> - Java
|
||
decompiler</li>
|
||
<li><a href="https://github.com/Storyyeller/Krakatau">Krakatau</a> -
|
||
Java decompiler</li>
|
||
<li><a href="https://github.com/fesh0r/fernflower">FernFlower</a> - Java
|
||
decompiler</li>
|
||
<li><a href="https://github.com/plum-umd/redexer">Redexer</a> – apk
|
||
manipulation</li>
|
||
<li><a href="https://github.com/CalebFenton/simplify">Simplify Android
|
||
deobfuscator</a></li>
|
||
<li><a href="https://github.com/Konloch/bytecode-viewer">Bytecode
|
||
viewer</a></li>
|
||
<li><a href="https://github.com/radare/radare2">Radare2</a></li>
|
||
<li><a href="https://github.com/skylot/jadx">Jadx</a></li>
|
||
<li><a href="https://github.com/iGio90/Dwarf">Dwarf</a> - GUI for
|
||
reverse engineering</li>
|
||
<li><a href="https://github.com/secrary/Andromeda">Andromeda</a> -
|
||
Another basic command-line reverse engineering tool</li>
|
||
<li><a href="https://github.com/shroudedcode/apk-mitm">apk-mitm</a> - A
|
||
CLI application that prepares Android APK files for HTTPS
|
||
inspection</li>
|
||
<li><a href="https://github.com/0x742/noia">Noia</a> - Simple Android
|
||
application sandbox file browser tool</li>
|
||
<li><a href="https://github.com/ClaudiuGeorgiu/Obfuscapk">Obfuscapk</a>
|
||
— Obfuscapk is a modular Python tool for obfuscating Android apps
|
||
without requiring their source code.</li>
|
||
<li><a
|
||
href="https://github.com/Mobile-IoT-Security-Lab/ARMANDroid">ARMANDroid</a>
|
||
- ARMAND (Anti-Repackaging through Multi-pattern, Anti-tampering based
|
||
on Native Detection) is a novel anti-tampering protection scheme that
|
||
embeds logic bombs and AT detection nodes directly in the apk file
|
||
without needing their source code.</li>
|
||
<li><a href="https://github.com/mvt-project/mvt">MVT (Mobile
|
||
Verification Toolkit)</a> - a collection of utilities to simplify and
|
||
automate the process of gathering forensic traces helpful to identify a
|
||
potential compromise of Android and iOS devices</li>
|
||
<li><a href="https://github.com/google/dexmod">Dexmod</a> - a tool to
|
||
exemplify patching Dalvik bytecode in a DEX (Dalvik Executable) file and
|
||
assist in the static analysis of Android applications.</li>
|
||
<li><a
|
||
href="https://github.com/giacomoferretti/odex-patcher">odex-patcher</a>
|
||
- Run arbitrary code by patching OAT files</li>
|
||
<li><a
|
||
href="https://github.com/AzeemIdrisi/PhoneSploit-Pro">PhoneSpolit-Pro</a>
|
||
- An all-in-one hacking tool to remotely exploit Android devices using
|
||
ADB and Metasploit Framework to get a Meterpreter session.</li>
|
||
<li><a href="https://github.com/APKLab/APKLab">APKLab</a> - plugin for
|
||
VS code to analyze APKs</li>
|
||
<li><del><a
|
||
href="https://bitbucket.org/mstrobel/procyon/wiki/Java%20Decompiler">Procyon</a>
|
||
- Java decompiler</del></li>
|
||
<li><del><a
|
||
href="http://blog.avlyun.com/wp-content/uploads/2014/04/SmaliViewer.zip">Smali
|
||
viewer</a></del></li>
|
||
<li><del><a
|
||
href="https://github.com/BaiduSecurityLabs/ZjDroid">ZjDroid</a></del>,
|
||
<del><a
|
||
href="https://github.com/yangbean9/ZjDroid">fork/mirror</a></del></li>
|
||
<li><del><a href="http://siis.cse.psu.edu/dare/index.html">Dare</a> –
|
||
.dex to .class converter</del></li>
|
||
</ol>
|
||
<h3 id="fuzz-testing">Fuzz Testing</h3>
|
||
<ol type="1">
|
||
<li><a href="https://github.com/anestisb/radamsa-android">Radamsa
|
||
Fuzzer</a></li>
|
||
<li><a href="https://github.com/google/honggfuzz">Honggfuzz</a></li>
|
||
<li><a href="https://github.com/anestisb/melkor-android">An Android port
|
||
of the Melkor ELF fuzzer</a></li>
|
||
<li><a href="https://github.com/fuzzing/MFFA">Media Fuzzing Framework
|
||
for Android</a></li>
|
||
<li><a href="https://github.com/jonmetz/AndroFuzz">AndroFuzz</a></li>
|
||
<li><a href="https://github.com/quarkslab/android-fuzzing">QuarksLab’s
|
||
Android Fuzzing</a></li>
|
||
<li><del><a
|
||
href="https://www.nccgroup.trust/us/about-us/resources/intent-fuzzer/">IntentFuzzer</a></del></li>
|
||
</ol>
|
||
<h3 id="app-repackaging-detectors">App Repackaging Detectors</h3>
|
||
<ol type="1">
|
||
<li><a href="https://github.com/zyrikby/FSquaDRA">FSquaDRA</a> - a tool
|
||
for detecting repackaged Android applications based on app resources
|
||
hash comparison.</li>
|
||
</ol>
|
||
<h3 id="market-crawlers">Market Crawlers</h3>
|
||
<ol type="1">
|
||
<li><a href="https://github.com/Akdeniz/google-play-crawler">Google Play
|
||
crawler (Java)</a></li>
|
||
<li><a href="https://github.com/egirault/googleplay-api">Google Play
|
||
crawler (Python)</a></li>
|
||
<li><a href="https://github.com/dweinstein/node-google-play">Google Play
|
||
crawler (Node)</a> - get app details and download apps from the official
|
||
Google Play Store.</li>
|
||
<li><a href="https://github.com/dweinstein/node-aptoide">Aptoide
|
||
downloader (Node)</a> - download apps from Aptoide third-party Android
|
||
market</li>
|
||
<li><a href="https://github.com/dweinstein/node-appland">Appland
|
||
downloader (Node)</a> - download apps from Appland third-party Android
|
||
market</li>
|
||
<li><a
|
||
href="https://github.com/ClaudiuGeorgiu/PlaystoreDownloader">PlaystoreDownloader</a>
|
||
- PlaystoreDownloader is a tool for downloading Android applications
|
||
directly from the Google Play Store. After an initial (one-time)
|
||
configuration, applications can be downloaded by specifying their
|
||
package name.</li>
|
||
<li><a href="https://apkcombo.com/apk-downloader/">APK Downloader</a>
|
||
Online Service to download APK from the Play Store for a specific
|
||
Android Device Configuration</li>
|
||
<li><del><a href="https://apkpure.com/">Apkpure</a> - Online apk
|
||
downloader. Also, it provides its own app for downloading.</del></li>
|
||
</ol>
|
||
<h3 id="misc-tools">Misc Tools</h3>
|
||
<ol type="1">
|
||
<li><a
|
||
href="http://androidcracking.blogspot.com/2011/03/original-smalihook-java-source.html">smalihook</a></li>
|
||
<li><a
|
||
href="http://code.google.com/p/android4me/downloads/detail?name=AXMLPrinter2.jar">AXMLPrinter2</a>
|
||
- to convert binary XML files to human-readable XML files</li>
|
||
<li><a href="https://github.com/mbrubeck/android-completion">adb
|
||
autocomplete</a></li>
|
||
<li><a href="https://github.com/mitmproxy/mitmproxy">mitmproxy</a></li>
|
||
<li><a
|
||
href="https://github.com/dweinstein/dockerfile-androguard">dockerfile/androguard</a></li>
|
||
<li><a href="https://github.com/AndroidVTS/android-vts">Android
|
||
Vulnerability Test Suite</a> - android-vts scans a device for set of
|
||
vulnerabilities</li>
|
||
<li><a href="https://github.com/dpnishant/appmon">AppMon</a>- AppMon is
|
||
an automated framework for monitoring and tampering with system API
|
||
calls of native macOS, iOS, and Android apps. It is based on Frida.</li>
|
||
<li><a href="https://github.com/seemoo-lab/internalblue">Internal
|
||
Blue</a> - Bluetooth experimentation framework based on the Reverse
|
||
Engineering of Broadcom Bluetooth Controllers</li>
|
||
<li><a href="https://github.com/SecTheTech/AMDH">Android Mobile Device
|
||
Hardening</a> - AMDH scans and hardens the device’s settings and lists
|
||
harmful installed Apps based on permissions.</li>
|
||
<li><a
|
||
href="https://github.com/AndroidDumps/Firmware_extractor">Firmware
|
||
Extractor</a> - Extract given archive to images</li>
|
||
<li><a href="https://github.com/R0rt1z2/kaeru">ARMv7 payload that
|
||
provides arbitrary code execution on MediaTek bootloaders</a><br />
|
||
</li>
|
||
<li><del><a
|
||
href="https://www.android-device-security.org/client/datatable">Android
|
||
Device Security Database</a> - Database of security features of Android
|
||
devices</del></li>
|
||
<li><del><a
|
||
href="http://ww38.xchg.info/corkami/opcodes_tables.pdf">Opcodes table
|
||
for quick reference</a></del></li>
|
||
<li><del><a
|
||
href="http://codekiem.com/2012/02/24/apk-downloader/">APK-Downloader</a></del>
|
||
- seems dead now</li>
|
||
<li><del><a
|
||
href="http://pallergabor.uw.hu/androidblog/dalvik_opcodes.html">Dalvik
|
||
opcodes</a></del></li>
|
||
</ol>
|
||
<h3 id="vulnerable-applications-for-practice">Vulnerable Applications
|
||
for practice</h3>
|
||
<ol type="1">
|
||
<li><a href="https://github.com/payatu/diva-android">Damn Insecure
|
||
Vulnerable Application (DIVA)</a></li>
|
||
<li><a
|
||
href="https://github.com/jaiswalakshansh/Vuldroid">Vuldroid</a></li>
|
||
<li><a
|
||
href="http://securitycompass.github.io/AndroidLabs/setup.html">ExploitMe
|
||
Android Labs</a></li>
|
||
<li><a
|
||
href="https://github.com/jackMannino/OWASP-GoatDroid-Project">GoatDroid</a></li>
|
||
<li><a
|
||
href="https://github.com/dineshshetty/Android-InsecureBankv2">Android
|
||
InsecureBank</a></li>
|
||
<li><a
|
||
href="https://github.com/optiv/insecureshop">Insecureshop</a></li>
|
||
<li><a href="https://github.com/oversecured/ovaa">Oversecured Vulnerable
|
||
Android App (OVAA)</a></li>
|
||
</ol>
|
||
<h2
|
||
id="academicresearchpublicationsbooks">Academic/Research/Publications/Books</h2>
|
||
<h3 id="research-papers">Research Papers</h3>
|
||
<ol type="1">
|
||
<li><a href="https://www.exploit-db.com/papers/">Exploit
|
||
Database</a></li>
|
||
<li><a href="https://github.com/jacobsoo/AndroidSlides">Android
|
||
security-related presentations</a></li>
|
||
<li><a
|
||
href="https://tthtlc.wordpress.com/2011/09/01/static-analysis-of-android-applications/">A
|
||
good collection of static analysis papers</a></li>
|
||
</ol>
|
||
<h3 id="books">Books</h3>
|
||
<ol type="1">
|
||
<li><a
|
||
href="https://wiki.sei.cmu.edu/confluence/display/android/Android+Secure+Coding+Standard">SEI
|
||
CERT Android Secure Coding Standard</a></li>
|
||
</ol>
|
||
<h3 id="others">Others</h3>
|
||
<ol type="1">
|
||
<li><a href="https://github.com/OWASP/owasp-mstg">OWASP Mobile Security
|
||
Testing Guide Manual</a></li>
|
||
<li><a
|
||
href="https://github.com/doridori/Android-Security-Reference">doridori/Android-Security-Reference</a></li>
|
||
<li><a
|
||
href="https://github.com/b-mueller/android_app_security_checklist">android
|
||
app security checklist</a></li>
|
||
<li><a
|
||
href="https://github.com/tanprathan/MobileApp-Pentest-Cheatsheet">Mobile
|
||
App Pentest Cheat Sheet</a></li>
|
||
<li><a
|
||
href="https://web.archive.org/web/20180721134044/http://www.fasteque.com:80/android-reverse-engineering-101-part-1/">Android
|
||
Reverse Engineering 101 by Daniele Altomare (Web Archive link)</a></li>
|
||
<li><del><a href="https://mobile-security.zeef.com">Mobile Security
|
||
Reading Room</a> - A reading room that contains well-categorized
|
||
technical reading material about mobile penetration testing, mobile
|
||
malware, mobile forensics, and all kinds of mobile security-related
|
||
topics</del></li>
|
||
</ol>
|
||
<h2 id="exploitsvulnerabilitiesbugs">Exploits/Vulnerabilities/Bugs</h2>
|
||
<h3 id="list">List</h3>
|
||
<ol type="1">
|
||
<li><a href="https://source.android.com/security/bulletin/">Android
|
||
Security Bulletins</a></li>
|
||
<li><a
|
||
href="https://www.cvedetails.com/vulnerability-list/vendor_id-1224/product_id-19997/Google-Android.html">Android’s
|
||
reported security vulnerabilities</a></li>
|
||
<li><a
|
||
href="https://www.owasp.org/index.php/Mobile_Top_10_2016-Top_10">OWASP
|
||
Mobile Top 10 2016</a></li>
|
||
<li><a
|
||
href="https://www.exploit-db.com/search/?action=search&q=android">Exploit
|
||
Database</a> - click search</li>
|
||
<li><a
|
||
href="https://docs.google.com/spreadsheet/pub?key=0Am5hHW4ATym7dGhFU1A4X2lqbUJtRm1QSWNRc3E0UlE&single=true&gid=0&output=html">Vulnerability
|
||
Google Doc</a></li>
|
||
<li><a
|
||
href="https://source.android.com/security/reports/Google_Android_Security_PHA_classifications.pdf">Google
|
||
Android Security Team’s Classifications for Potentially Harmful
|
||
Applications (Malware)</a></li>
|
||
<li><del><a
|
||
href="https://kb.androidtamer.com/Device_Security_Patch_tracker/">Android
|
||
Devices Security Patch Status</a></del></li>
|
||
</ol>
|
||
<h3 id="malware">Malware</h3>
|
||
<ol type="1">
|
||
<li><a
|
||
href="https://code.google.com/p/androguard/wiki/DatabaseAndroidMalwares">androguard
|
||
- Database Android Malware wiki</a></li>
|
||
<li><a href="https://github.com/ashishb/android-malware">Android Malware
|
||
Github repo</a></li>
|
||
<li><a href="http://www.malgenomeproject.org/">Android Malware Genome
|
||
Project</a> - contains 1260 malware samples categorized into 49
|
||
different malware families, free for research purposes.</li>
|
||
<li><a href="http://contagiominidump.blogspot.com">Contagio Mobile
|
||
Malware Mini Dump</a></li>
|
||
<li><a href="https://www.sec.tu-bs.de/~danarp/drebin/">Drebin</a></li>
|
||
<li><a
|
||
href="https://www.hudsonrock.com/threat-intelligence-cybercrime-tools">Hudson
|
||
Rock</a> - A Free cybercrime intelligence toolset that can indicate if a
|
||
specific APK package was compromised in an Infostealer malware
|
||
attack.</li>
|
||
<li><a href="http://kharon.gforge.inria.fr/dataset/">Kharon Malware
|
||
Dataset</a> - 7 malware which have been reverse-engineered and
|
||
documented</li>
|
||
<li><a
|
||
href="https://www.unb.ca/cic/datasets/android-adware.html">Android
|
||
Adware and General Malware Dataset</a></li>
|
||
<li><a href="https://androzoo.uni.lu/">AndroZoo</a> - AndroZoo is a
|
||
growing Android application collection from several sources, including
|
||
the official Google Play app market.</li>
|
||
<li><del><a
|
||
href="http://pralab.diee.unica.it/en/AndroidPRAGuardDataset">Android
|
||
PRAGuard Dataset</a> - The dataset contains 10479 samples, obtained by
|
||
obfuscating the MalGenome and the Contagio Minidump datasets with seven
|
||
different obfuscation techniques.</del></li>
|
||
<li><del><a href="http://admire.necst.it/">Admire</a></del></li>
|
||
</ol>
|
||
<h3 id="bounty-programs">Bounty Programs</h3>
|
||
<ol type="1">
|
||
<li><a
|
||
href="https://www.google.com/about/appsecurity/android-rewards/">Android
|
||
Security Reward Program</a></li>
|
||
</ol>
|
||
<h3 id="how-to-report-security-issues">How to report Security
|
||
issues</h3>
|
||
<ol type="1">
|
||
<li><a
|
||
href="https://source.android.com/security/overview/updates-resources.html#report-issues">Android
|
||
- reporting security issues</a></li>
|
||
<li><a
|
||
href="https://github.com/B3nac/Android-Reports-and-Resources">Android
|
||
Reports and Resources</a> - List of Android Hackerone disclosed reports
|
||
and other resources</li>
|
||
</ol>
|
||
<h2 id="contributing">Contributing</h2>
|
||
<p>Your contributions are always welcome!</p>
|
||
<h2 id="citation">📖 Citation</h2>
|
||
<div class="sourceCode" id="cb1"><pre
|
||
class="sourceCode bibtex"><code class="sourceCode bibtex"><span id="cb1-1"><a href="#cb1-1" aria-hidden="true" tabindex="-1"></a><span class="va">@misc</span>{</span>
|
||
<span id="cb1-2"><a href="#cb1-2" aria-hidden="true" tabindex="-1"></a> <span class="ot">author</span> = {<span class="ot">Ashish</span> <span class="ot">Bhatia</span> - <span class="ot">ashishb</span>.<span class="ot">net</span>}<span class="co">,</span></span>
|
||
<span id="cb1-3"><a href="#cb1-3" aria-hidden="true" tabindex="-1"></a><span class="co"> title = {The most comprehensive collection of Android Security related resources},</span></span>
|
||
<span id="cb1-4"><a href="#cb1-4" aria-hidden="true" tabindex="-1"></a><span class="co"> year = {2025},</span></span>
|
||
<span id="cb1-5"><a href="#cb1-5" aria-hidden="true" tabindex="-1"></a><span class="co"> publisher = {GitHub},</span></span>
|
||
<span id="cb1-6"><a href="#cb1-6" aria-hidden="true" tabindex="-1"></a><span class="co"> journal = {GitHub repository},</span></span>
|
||
<span id="cb1-7"><a href="#cb1-7" aria-hidden="true" tabindex="-1"></a><span class="co"> howpublished = {\url{https://github.com/ashishb/android-security-awesome}}</span></span>
|
||
<span id="cb1-8"><a href="#cb1-8" aria-hidden="true" tabindex="-1"></a><span class="co">}</span></span></code></pre></div>
|
||
<p>This repository has been cited in <a
|
||
href="https://scholar.google.com/scholar?q=github.com%2Fashishb%2Fandroid-security-awesome">10+
|
||
papers</a></p>
|
||
<p><a
|
||
href="https://github.com/ashishb/android-security-awesome">androidsecurity.md
|
||
Github</a></p>
|