awesome-mobile-security awesome-mobile-security Maintained by @vaib25vicky with contributions from the security and developer communities.AndroidGeneral - Blogs, Papers, How To'sAndroid: Gaining access to arbitrary* Content ProvidersEvernote: Universal-XSS, theft of all cookies from all sites, and moreInterception of Android implicit intentsTikTok: three persistent arbitrary code executions and one theft of arbitrary filesPersistent arbitrary code execution in Android's Google Play Core Library: details, explanation and the PoC - CVE-2020-8913Android: Access to app protected componentsAndroid: arbitrary code execution via third-party package contextsAndroid Pentesting Labs - Step by Step guide for beginnersAn Android Hacking PrimerSecure an Android DeviceSecurity tipsOWASP Mobile Security Testing GuideSecurity Testing for Android Cross Platform ApplicationDive deep into Android Application SecurityPentesting Android Apps Using FridaMobile Security Testing GuideMobile Application Penetration Testing Cheat SheetAndroid Applications Reversing 101Android Security GuidelinesAndroid WebView VulnerabilitiesOWASP Mobile Top 10Practical Android Phone ForensicsMobile Reverse Engineering UnleashedAndroid Root Detection Bypass Using Objection and Frida Scriptsquark-engine - An Obfuscation-Neglect Android Malware Scoring SystemRoot Detection Bypass By Manual Code Manipulation.Application and Network Usage in AndroidGEOST BOTNET - the discovery story of a new Android banking trojanMobile Pentesting With FridaMagisk Systemless Root - Detection and RemediationAndrODet: An adaptive Android obfuscation detectorHands On Mobile API SecurityZero to Hero - Mobile Application Testing - Android PlatformHow to use FRIDA to bruteforce Secure Startup with FDE-encryption on a Samsung G935F running Android 8Android Malware AdventuresAAPG - Android application penetration testing guideBypassing Android Anti-EmulationBypassing Xamarin Certificate PinningConfiguring Burp Suite With Android NougatBooksSEI CERT Android Secure Coding StandardAndroid Security InternalsAndroid CookbookAndroid Hacker's HandbookAndroid Security CookbookThe Mobile Application Hacker's HandbookAndroid Malware and AnalysisAndroid Security: Attacks and DefensesCoursesLearning-Android-SecurityMobile Application Security and Penetration TestingAdvanced Android DevelopmentLearn the art of mobile app developmentLearning Android Malware AnalysisAndroid App Reverse Engineering 101Android Pentesting for BeginnersToolsStatic AnalysisAmandroid – A Static Analysis FrameworkAndrowarn – Yet Another Static Code AnalyzerAPK Analyzer – Static and Virtual Analysis ToolAPK Inspector – A Powerful GUI ToolDroid Hunter – Android application vulnerability analysis and Android pentest toolError Prone – Static Analysis ToolFindbugs – Find Bugs in Java ProgramsFind Security Bugs – A SpotBugs plugin for security audits of Java web applications.Flow Droid – Static Data Flow TrackerSmali/Baksmali – Assembler/Disassembler for the dex formatSmali-CFGs – Smali Control Flow Graph’sSPARTA – Static Program Analysis for Reliable Trusted AppsThresher – To check heap reachability propertiesVector Attack Scanner – To search vulnerable points to attackGradle Static Analysis PluginCheckstyle – A tool for checking Java source codePMD – An extensible multilanguage static code analyzerSoot – A Java Optimization FrameworkAndroid Quality StarterQARK – Quick Android Review KitInfer – A Static Analysis tool for Java, C, C++ and Objective-CAndroid Check – Static Code analysis plugin for Android ProjectFindBugs-IDEA Static byte code analysis to look for bugs in Java codeAPK Leaks – Scanning APK file for URIs, endpoints & secretsDynamic AnalysisAdhrit - Android Security Suite for in-depth reconnaissance and static bytecode analysis based on Ghera benchmarksAndroid Hooker - Opensource project for dynamic analyses of Android applicationsAppAudit - Online tool ( including an API) uses dynamic and static analysisAppAudit - A bare-metal analysis tool on Android devicesCuckooDroid - Extension of Cuckoo Sandbox the Open Source softwareDroidBox - Dynamic analysis of Android applicationsDroid-FF - Android File Fuzzing FrameworkDrozerMarvin - Analyzes Android applications and allows tracking of an appInspeckagePATDroid - Collection of tools and data structures for analyzing Android applicationsAndroL4b - Android security virtual machine based on ubuntu-mateRadare2 - Unix-like reverse engineering framework and commandline toolsCutter - Free and Open Source RE Platform powered by radare2ByteCodeViewer - Android APK Reverse Engineering Suite (Decompiler, Editor, Debugger)Mobile-Security-Framework MobSFCobraDroid - Custom build of the Android operating system geared specifically for application security Magisk v20.2 - Root & Universal Systemless InterfaceRuntime Mobile Security (RMS) - is a powerful web interface that helps you to manipulate Android and iOS Apps at RuntimeMOBEXLER - A Mobile Application Penetration Testing PlatformAndroid Online APK Analyzers Oversecured - A static vulnerability scanner for Android apps (APK files) containing 90+ vulnerability categoriesAndroid Observatory APK ScanAndroid APK DecompilerAndroTotalNVISO ApkScanVirusTotalScan Your APKAVC UndroidOPSWATImmuniWeb Mobile App ScannerOstor LabQuixxiTraceDroidVisual ThreatApp CritiqueLabsOVAA (Oversecured Vulnerable Android App)DIVA (Damn insecure and vulnerable App)SecurityShepherdDamn Vulnerable Hybrid Mobile App (DVHMA)OWASP-mstgVulnerableAndroidAppOracleAndroid InsecureBankv2Purposefully Insecure and Vulnerable Android Application (PIIVA)Sieve appDodoVulnerableBankDigitalbankOWASP GoatDroidAppKnox Vulnerable ApplicationVulnerable Android ApplicationMoshZukHackme BankAndroid Security LabsAndroid-InsecureBankv2Android-securityVulnDroidFridaLabSantoku Linux - Mobile Security VMVuldroidTalksBlowing the Cover of Android Binary Fuzzing (Slides)One Step Ahead of Cheaters -- Instrumenting Android EmulatorsVulnerable Out of the Box: An Evaluation of Android Carrier DevicesRock appround the clock: Tracking malware developers by AndroidChaosdata - Ghost in the Droid: Possessing Android Applications with ParaSpectreRemotely Compromising Android and iOS via a Bug in Broadcom's Wi-Fi ChipsetsHoney, I Shrunk the Attack Surface – Adventures in Android Security HardeningHide Android Applications in ImagesScary Code in the Heart of AndroidFuzzing Android: A Recipe For Uncovering Vulnerabilities Inside System Components In AndroidUnpacking the Packed Unpacker: Reverse Engineering an Android Anti-Analysis Native LibraryAndroid FakeID Vulnerability WalkthroughUnleashing D* on Android Kernel DriversThe Smarts Behind Hacking Dumb DevicesOverview of common Android app vulnerabilitiesAndroid Dev Summit 2019Android security architectureGet the Ultimate Privilege of Android PhoneMisc.Android-Reports-and-Resourcesandroid-security-awesomeAndroid Penetration Testing CoursesLesser-known Tools for Android Application PenTestingandroid-device-check - a set of scripts to check Android device security configurationapk-mitm - a CLI application that prepares Android APK files for HTTPS inspectionAndriller - is software utility with a collection of forensic tools for smartphonesDexofuzzy: Android malware similarity clustering method using opcode sequence-PaperChasing the JokerSide Channel Attacks in 4G and 5G Cellular Networks-SlidesShodan.io-mobile-app for AndroidPopular Android Malware 2018Popular Android Malware 2019Popular Android Malware 2020iOSGeneral - Blogs, Papers, How to'siOS SecurityBasic iOS Apps Security Testing labIOS Application security – Setting up a mobile pentesting platformCollection of the most common vulnerabilities found in iOS applicationsIOS_Application_Security_Testing_Cheat_SheetOWASP iOS Basic Security TestingDynamic analysis of iOS apps w/o JailbreakiOS Application InjectionLow-Hanging Apples: Hunting Credentials and Secrets in iOS AppsCheckra1n Era - seriesBFU Extraction: Forensic Analysis of Locked and Disabled iPhonesHowTo-decrypt-Signal.sqlite-for-IOSCan I Jailbreak?How to Extract Screen Time Passcodes and Voice Memos from iCloudReverse Engineering Swift AppsMettle your iOS with FRIDAA run-time approach for pentesting iOS applicationsiOS Internals vol 2Understanding usbmux and the iOS lockdown serviceA Deep Dive into iOS Code SigningAirDoS: remotely render any nearby iPhone or iPad unusableHow to access and traverse a #checkra1n jailbroken iPhone File system using SSHDeep dive into iOS Exploit chains found in the wild - Project ZeroThe Fully Remote Attack Surface of the iPhone - Project ZeroBooksHacking and Securing iOS Applications: Stealing Data, Hijacking Software, and How to Prevent ItiOS Penetration TestingiOS App Security, Penetration Testing, and DevelopmentIOS Hacker's HandbookHacking iOS Applications a detailed testing guideDevelop iOS Apps (Swift)iOS Programming CookbookCoursesPentesting iOS ApplicationsReverse Engineering iOS ApplicationsApp Design and Development for iOSToolsCydia Impactorcheckra1n jailbreakidb - iOS App Security Assessment ToolFridaObjection - mobile exploration toolkit by FridaBfinjectiFunboxLibimobiledevice - library to communicate with the services of the Apple ios devices iRET (iOS Reverse Engineering Toolkit) - includes oTool, dumpDecrypted, SQLite, Theos, Keychain_dumper, PlutilMyriam iOSiWep Pro - wireless suite of useful applications used to turn your iOS device into a wireless network diagnostic toolBurp SuiteCycriptneedle - The iOS Security Testing FrameworkiLEAPP - iOS Logs, Events, And Preferences ParserCutter - Free and Open Source RE Platform powered by radare2decrypt0r - automatically download and decrypt SecureRom stuffiOS Security Suite - an advanced and easy-to-use platform security & anti-tampering libraryLabsOWASP iGoatDamn Vulnerable iOS App (DVIA) v2Damn Vulnerable iOS App (DVIA) v1iPhoneLabsiOS-Attack-DefenseTalksBehind the Scenes of iOS SecurityModern iOS Application SecurityDemystifying the Secure Enclave ProcessorHackPac Hacking Pointer Authentication in iOS User SpaceAnalyzing and Attacking Apple Kernel DriversRemotely Compromising iOS via Wi-Fi and Escaping the SandboxReverse Engineering iOS Mobile AppsiOS 10 Kernel Heap RevisitedKTRW: The journey to build a debuggable iPhoneThe One Weird Trick SecureROM HatesTales of old: untethering iOS 11-Spoiler: Apple is bad at patchingMessenger Hacking: Remotely Compromising an iPhone through iMessageRecreating An iOS 0-Day Jailbreak Out Of Apple's Security UpdatesReverse Engineering the iOS Simulator’s SpringBoardAttacking iPhone XS MaxMisc.Most usable tools for iOS penetration testingiOS-Security-Guidesosx-security-awesome - OSX and iOS related security toolsTrust in Apple's Secret Garden: Exploring & Reversing Apple's Continuity Protocol-SlidesApple Platform SecurityMobile security, forensics & malware analysis with Santoku Linux
