Android Security Awesome

An interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers.

MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potential compromise.

The OWASP Mobile Application Security Testing Guide (MASTG) is a comprehensive manual for mobile app security testing and reverse engineering. It describes technical processes for verifying the OWASP Mobile Security Weakness Enumeration (MASWE) weaknesses, which are in alignment with the OWASP MASVS.

An all-in-one hacking tool to remotely take over Android devices.

Reverse engineering and pentesting for Android applications

Scanning APK file for URIs, endpoints & secrets.

The Leading Security Assessment Framework for Android.

Tool to look for several security related Android application vulnerabilities

An on-path blackbox network traffic security testing tool

No description.

No description.

📱 Andriller - is software utility with a collection of forensic tools for smartphones. It performs read-only, forensically sound, non-destructive acquisition from Android devices.

Full featured multi arch/os debugger built on top of PyQt5 and frida

An automatic obfuscation tool for Android apps that works in a black-box fashion, supports advanced obfuscation features and has a modular architecture easily extensible with new techniques

AndroBugs Framework is an efficient Android vulnerability scanner that helps developers or hackers find potential security vulnerabilities in Android applications. No need to install on Windows.

A command line tool to download Android applications directly from the Google Play Store by specifying their package name (an initial one-time configuration is required)

A python based tool for exploiting and managing Android devices via ADB

Google Play Unofficial Python API - This project was a PoC and is not maintained anymore. Please feel free to fork it and improve it in any way.

Dynamic analysis of Android apps

Bluetooth experimentation framework for Broadcom and Cypress chips.

MARA is a Mobile Application Reverse engineering and Analysis Framework. It is a toolkit that puts together commonly used mobile application reverse engineering and analysis tools to assist in testing mobile applications against the OWASP mobile security threats.

CuckooDroid - Automated Android Malware Analysis with Cuckoo Sandbox.

Android Debugging Library

Simplifying encrypted traffic analysis for researchers by making protocol decryption effortless.

Hooker is an opensource project for dynamic analyses of Android applications. This project provides various tools and applications that can be use to automaticaly intercept and modify any API calls made by a targeted application.

A framework for automated extraction of static and dynamic features from Android applications

Extract given archive to images

Media Fuzzing Framework for Android

Static Code Analysis for Smali files

One-Step APK Decompilation With Multiple Backends

Django application that performs SAST and Malware Analysis for Android APKs

Android Mobile Device Hardening

Android Framework for Exploitation, is a framework for exploiting android based devices

The tool is used to analyze the content of the android application in local storage.

A tool for quantitative risk analysis of Android applications based on machine learning techniques

Simple framework to extract "actionable" data from Android malware (C&Cs, phone numbers etc.)

Mobile runtime detection workbench for AI (iOS and Android)

The MPT (Mobile Pentest Toolkit) is a must-have solution for your android penetration testing workflow.

No description.

A fuzzing utility for Android that focuses on reporting and delivery portions of the fuzzing process

Practical security policy enforcement for Android apps via bytecode rewriting and in-place reference monitor

linux version (rewrite in Python)

Authorized Android pentest lab, drivable by hand or by AI — Frida bypass chain, live traffic capture with automatic IDOR flagging, full MCP control plane, web dashboard.