Open highlighted repo slot
Put your repository first
Promote a GitHub repo at the top of Awesome repository list views for 7 days.
Awesome List
A collection of android security related resources
GitHub stars and default-branch commits for ashishb/android-security-awesome.
Open highlighted repo slot
Promote a GitHub repo at the top of Awesome repository list views for 7 days.
Dex to Java decompiler
A tool for reverse engineering Android apk files
A standalone Java Decompiler GUI
The OWASP Mobile Application Security Testing Guide (MASTG) is a comprehensive manual for mobile app security testing and reverse engineering. It describes technical processes for verifying the OWASP Mobile Security Weakness Enumeration (MASWE) weaknesses, which are in alignment with the OWASP MASVS.
Tools to work with android .dex and java .class files
Android and Java bytecode viewer
Static code analysis for Kotlin
smali/baksmali
Reverse engineering and pentesting for Android applications
Android virtual machine and deobfuscator
Decompiler from Java bytecode to Java, used in IntelliJ IDEA.
Tool to look for several security related Android application vulnerabilities
Android Package Inspector - dynamic analysis with api hooks, start unexported activities and more. (Xposed Module)
An on-path blackbox network traffic security testing tool
The new bridge between Burp Suite and Frida!
Vulnerable Android application for developers and security enthusiasts to learn about Android insecurities
DIVA Android - Damn Insecure and vulnerable App for Android
Android Vulnerability Test Suite - In the spirit of open data collection, and with the help of the community, let's take a pulse on the state of Android security. NowSecure presents an on-device app to test for recent device vulnerabilities.
Oversecured Vulnerable Android App
A vulnerable Android application that shows simple examples of vulnerabilities in a ctf style.
MARA is a Mobile Application Reverse engineering and Analysis Framework. It is a toolkit that puts together commonly used mobile application reverse engineering and analysis tools to assist in testing mobile applications against the OWASP mobile security threats.
Simplifying encrypted traffic analysis for researchers by making protocol decryption effortless.
Joint Advanced Defect assEsment for android applications
An Intentionally designed Vulnerable Android Application built in Kotlin.
A SDK for the creation of analysis tools without obtaining app source code in order to profile runtime performance, examine code coverage, and track high-risk behaviors of a given app on Android 5.0 and above.
Radio frequency scanner with recon and offensive capabilities
GUI for Frida -Scripts
The Redexer binary instrumentation framework for Dalvik bytecode
Zygisk module that intercepts Flutter app traffic — redirects to a proxy and bypasses BoringSSL TLS pinning. Persistent, no Frida session. Installable via MMRL.
A flexible playground for Android CTF challenges.
Run arbitrary code by patching OAT files
Mobile runtime detection workbench for AI (iOS and Android)
Vuldroid is a Vulnerable Android Application made with security issues in order to demonstrate how they can occur in code
📱 Damn Vulnerable Mobile App - a single Flutter codebase that builds real native iOS & Android binaries with 200+ intentionally-vulnerable modules mapped to OWASP MASVS/MASTG, Mobile Top 10, CWE, plus LLM & Agentic AI Top 10. For mobile security training, pentest practice, and scanner validation.
Android app that runs 23 runtime integrity checks: root, Frida, Xposed, tampering, Play Integrity, SSL pinning and more