31 matches found
awesome-android-security
Awesome-Android-Security ē®å½ å客 ęä½ęå č®ŗę 书ē± å¹č® å·„å · éęåęå·„å · åØęåęå·„å · åØēŗæAPKåęåØ åØēŗæAPKåē¼čÆåØ åčÆåęå·„å · å®éŖ室 ę¼č®² ę锹 ę¼ę“čµéäøWriteup éę„č”Ø ę£ę„ęø å ę¼ę“čµéę„å å客 é©å½ę大ē§»åØč天åŗēØäøēäøé®ę¼ę“ å°ē±³č®¾å¤äøåē°ē20äøŖå®å Øé®é¢ ē»čæAndroidäøInstagramåThreadsēSSLčÆ书åŗå® éåå·„ēØAndroidęøøęCoin Hunt Worldåå ¶éäæ”å议仄ä½å¼ åē°Androidäøē¹å®äŗååēę¼ę“ Alien Androidę¶ęč½Æ件ēęęÆåę Androidč®¾å¤ēéå±ē»čæę¼ę“...
jadx-ai-mcp
JADX-AI-MCP Part of Zin MCP Suite ā” Fully automated MCP server + JADX plugin built to communicate with LLM through MCP to analyze Android APKs using LLMs like Claude ā uncover vulnerabilities, analyze APK, and reverse engineer effortlessly. ā Contributors Thanks to these wonderful people for thei...
Android-Disassembler
Android-Disassembler CodeFactor ć¹ćć¼ććć©ć³ć§ęŖęć®ććć¢ććŖćč§£ę ć”ć³ććć³ć¹ē¶ę³ ć”ć³ććć³ć¹ćÆåéććć¾ćććććććøć§ćÆććÆć¾ć 復ę§ćØčæ代åć®ę®µéć«ććć¾ćć ćć¼ć¹ć©ć¤ć³ć§ćÆććć«ćåć«ćµćć¢ćøć„ć¼ć«ćåęåććć¦ććććØćåęćØćŖćć¾ćć ććć©ć«ćć®éć/ć¤ć³ćć¼ć/ćØćÆć¹ćć¼ćććć¼ćÆćęę°ć®Androidć§ćÆSAFćć”ć¼ć¹ćć®å„ē“ćä½æēØćć¾ćć é«åŗ¦ćŖć¤ć³ćć¼ććÆćrootćēćć”ć¤ć«ć·ć¹ćć ćć¤ć³ć¹ćć¼ć«ęøćæć¢ććŖć®ćć©ć¦ćøć³ć°ć®ććć®å„ć®ććÆć¼ć¦ć¼ć¶ć¼åććć¹ć§ćć...
android-security-awesome
android-security-awesome Androidć»ćć„ćŖćć£é¢é£ćŖć½ć¼ć¹ć®ć³ć¬ćÆć·ć§ć³ć§ćć 1. ćć¼ć« 2. å¦č”ć»ē ē©¶ć»åŗēē©ć»ęøē± 3. ćØćÆć¹ććć¤ćć»čå¼±ę§ć»ćć° ćć¼ć« ćŖć³ć©ć¤ć³ć¢ćć©ć¤ć¶ć¼ 1. Appknox - ęę 2. Virustotal 3. NowSecure Lab Automated - Androidććć³iOSć¢ćć¤ć«ć¢ććŖć®ć»ćć„ćŖćć£ćć¹ććč”ćććć®ćØć³ćæć¼ćć©ć¤ćŗåććć¼ć«ćLab AutomatedćÆććÆć©ć¦ćäøć®å®ę©ć§ć®åēč§£ęćØéēč§£ęćē¹å¾“ćØććę°åć§ēµęćčæćć¾ććęę 4. App Detonator -...
BFScan
BFScan ēØäŗåƹ APK / XAPK / APKM / DEX / JAR / WAR åŗēØčæč”åå§å¤ēēå·„å ·ć åØęŗ代ē åčµęŗäøęē“¢ē±»ä¼¼ URIćč·Æå¾ęåÆé„ēåē¬¦äø² ę ¹ę®é ē½®ę件ćē±»åę¹ę³ę³Øč§£ēęåå§ HTTP čÆ·ę±å OpenAPI č§č ęÆęē客ę·ē«Æåŗ Square Retrofit Ktorfit Feign ęÆęēęå”ē«Æåŗ Spring Web Annotations Spring SimpleUrlHandlerMapping Spring BeanNameUrlHandlerMapping JAX-RS, Jakarta RESTful Web Services JA...
Andromeda
Andromeda ä½æå¾åƹ Android åŗēØēåå§éåå·„ēØå·„ä½ę“åæ«ę“ē®åćäøå ¶ä»ęæ代ę¹ę”ēøęÆļ¼å®ä½æēØ C/C++ ē¼åļ¼å ·ęę¾čēę§č½ä¼åæć DEMO čÆ„å·„å ·å¤äŗę©ęå¼åé¶ę®µ ęå»ŗ č¦ę± clangļ¼apt install clang libzipļ¼apt install libz-dev opensslļ¼apt install libssl-dev make ./bin/andromeda androidapp.apk å½ä»¤ ä½č Lasha Khasaia @qazqaz ę³Øę ęåƹ Android ēē»éŖéåøøęéļ¼ę仄å¦ęęØęę¶é“ļ¼čÆ·č“”ē®ć å¾ åäŗ锹 ē¼åå·„å ·ęę”£...
httptoolkit
HTTP Toolkit...
slicer
Slicer A tool to automate the recon process on an APK file. Slicer accepts a path to an extracted APK file and then returns all the activities, receivers, and services which are exported and have null permissions and can be externally provoked. Note : The APK has to be extracted via jadx or...
Apkatshu
Apkatshu ApkatshućÆćAPKćć”ć¤ć«ććURLćć”ć¼ć«ć¢ćć¬ć¹ćIPć¢ćć¬ć¹ćććć³čå³ę·±ććć¼ćæćę½åŗććććć®ćć¼ć«ć§ć root@kitploit: Apkatshu : tool written in bash/python for extracting urls, emails, ip addresses, and interesting data from APK files. The user can choose either JADX or APKTOOL for de-compilation. ä½æēØę¹ę³ : JADX : root@kitploit:...
MARA_Framework
MARAFramework MARA ćÆM obile A pplication R everse engineering and A nalysis Frameworkļ¼ć¢ćć¤ć«ć¢ććŖć±ć¼ć·ć§ć³ćŖćć¼ć¹ćØć³ćøćć¢ćŖć³ć°ććć³åęćć¬ć¼ć ćÆć¼ćÆļ¼ć§ćććć®ćć¼ć«ćÆćäøč¬ēć«ä½æēØćććć¢ćć¤ć«ć¢ććŖć±ć¼ć·ć§ć³ć®ćŖćć¼ć¹ćØć³ćøćć¢ćŖć³ć°ććć³åęćć¼ć«ćć¾ćØććOWASPć¢ćć¤ć«ć»ćć„ćŖćć£č åØć«åƾććć¢ćć¤ć«ć¢ććŖć±ć¼ć·ć§ć³ć®ćć¹ććęÆę“ćć¾ćććć®ē®ēćÆćć¢ćć¤ć«ć¢ććŖć±ć¼ć·ć§ć³éēŗč ćć»ćć„ćŖćć£å°é家ć«ćØć£ć¦ććć®ćæć¹ćÆćććē°”åć§č¦Ŗććæććććć®ć«ććććØć§ćć MARA...
Artemis
Artemis ę¦č¦ APKć¤ć³ćć©ć¹ćć©ćÆćć£ćę¤ē“¢ććććć®ćć¼ć«ć ęä¾: HADESSćÆćčå¼±ę§åęćć·ććŖćŖę»ęčØē»ćć«ć¹ćæć ēµ±åäŗé²ćććøć§ćÆćć®å®č£ ćå«ćć¤ć³ćć©ć¹ćć©ćÆćć£ćØć½ććć¦ć§ć¢ćéćć¦ćę»ęēćµć¤ćć¼ć»ćć„ćŖćć£ćµć¼ćć¹ćęä¾ćć¦ćć¾ććä¼ę„ćē£ę„ćē ē©¶ęć®ćµć¤ćć¼č åØć®é²ę¢ćäøåæć«ę“»åćēµē¹ćć¦ćć¾ćć ć¤ć³ć¹ćć¼ć« root@kitploit: pip install -r requirements.txt python main.py ć³ćć³ćć©ć¤ć³ćŖćć·ć§ć³ root@kitploit: --help Display help --path Requir...
AndroPyTool
AndroPyTool ę“ę°ļ¼DroidBoxć®ć¤ć”ć¼ćøćäæ®ę£ććć¾ćććåēč§£ęćåä½ććććć«ćŖćć¾ććć ćććÆćAndroid...
qark
ćÆć¤ććÆAndroidć¬ćć„ć¼ććć ćć®ćć¼ć«ćÆćć½ć¼ć¹ć³ć¼ćć¾ććÆććć±ć¼ćøåćććAPKć®ććććć«ććć¦ćććć¤ćć®ć»ćć„ćŖćć£é¢é£ć®Androidć¢ććŖć±ć¼ć·ć§ć³čå¼±ę§ćę¢ćććć«čØčØććć¦ćć¾ććć¾ććēŗč¦ććčå¼±ę§ć®å¤ććęŖēØåÆč½ćŖćProof-of-Conceptććććć¤åÆč½ćŖAPKćADBć³ćć³ććä½ęććććØćć§ćć¾ćććć®ćć¼ć«ćÆććć仄å¤ćÆå®å ØćŖę”件äøć§ęŖēØåÆč½ćŖčå¼±ę§ć«ē¦ē¹ćå½ć¦ć¦ććććććć¹ćććć¤ć¹ćrootåććåæ č¦ćÆććć¾ććć åæ č¦ę”件 Python 2.7.13 ććć³ 3.6 ć§ćć¹ćęøćæ OSXćLinuxćWindows ć§ćć¹ćęøćæ ä½æēØ...
YAASA
YAASA YAASAļ¼Yet Another APK Static Analyzerļ¼ćÆćAPKć®č§£ęćę„½ććććć®ćć¬ć¼ć ćÆć¼ćÆć§ćć ćć®ćććøć§ćÆććÆ仄äøć®ćć¼ć«ćä½æēØććDjangoćć¬ć¼ć ćÆć¼ćÆäøć«ę§ēÆććć¦ćć¾ćć APKTool: Android apkćć”ć¤ć«ććŖćć¼ć¹ćØć³ćøćć¢ćŖć³ć°ććććć®ćć¼ć« AxmlParserPY: PythonēØAxmlParser PlagueScanner: ćŖć¼ćć³ć½ć¼ć¹ć®ćć«ćAVć¹ćć£ćć¼ćć¬ć¼ć ćÆć¼ćÆ ę°ććę©č½ćÆ analyze/libs/threads.py ć«čæ½å ć§ćć¾ćć ä½æćę¹...
MobSF has SSRF port restriction bypass in assetlinks_check
Summary MobSF's Android App Link assetlinks checker validates only the manifest android:host value with validhost, but then appends the separate android:port value into the URL used for the server-side request. This bypasses the current port restriction in validhost and lets a crafted APK cause...
PYSEC-2026-1675 Mobile Security Framework (MobSF) Allows Stored Cross Site Scripting (XSS) via malicious SVG Icon Upload
Vulnerable MobSF Versions: .svg This file becomes publicly accessible via the web interface at: http://127.0.0.1:8081/download/filename.svg If the SVG contains embedded JavaScript e.g., an XSS payload, accessing this URL via a browser leads to the execution of the script in the context of the Mob...
Exploit for Race Condition in Canonical Ubuntu_Linux
Dillu-Analyzer š”ļø Dillu Analyzer ā A web-based universal malwa...
EUVD-2025-13371
Malicious code in bioql PyPI...
Cross-site Scripting (XSS)
mobsf is vulnerable to Stored Cross-Site Scripting XSS. The vulnerability is due to improper input sanitization during SVG file handling in the Android APK analysis workflow, which allows malicious scripts to be embedded in the SVG files...
CVE-2025-46335
Mobile Security Framework MobSF is a security research platform for mobile applications in Android, iOS and Windows Mobile. A Stored Cross-Site Scripting XSS vulnerability has been identified in MobSF versions up to and including 4.3.2. The vulnerability arises from improper sanitization of...