qark

Быстрый набор для проверки Android Этот инструмент предназначен для поиска различных уязвимостей в Android-приложениях, связанных с безопасностью, как в исходном коде, так и в упакованных APK. Инструмент также способен создавать «Proof-of-Concept» развёртываемые APK и/или ADB-команды, способные...

Artemis

Artemis Übersicht Ein Werkzeug zum Finden von APK-Infrastruktur. Bereitgestellt von: HADESS führt offensive Cybersicherheitsdienste durch Infrastrukturen und Software durch, die Schwachstellenanalyse, Angriffsszenarienplanung und die Implementierung kundenspezifischer integrierter...

jadx-ai-mcp

JADX-AI-MCP Part of Zin MCP Suite ⚡ Fully automated MCP server + JADX plugin built to communicate with LLM through MCP to analyze Android APKs using LLMs like Claude — uncover vulnerabilities, analyze APK, and reverse engineer effortlessly. ⭐ Contributors Thanks to these wonderful people for thei...

gradle-static-analysis-plugin

DEPRECATED Gradle static analysis plugin ⚠️ A fork of this project is maintained at https://github.com/GradleUp/static-analysis-plugin/ Please migrate by using com.gradleup.static-analysis plugin id instead. A Gradle plugin to easily apply the same setup of static analysis tools across different...

AndroPyTool

AndroPyTool Aggiornamento! Le immagini di DroidBox sono state riparate. L'analisi dinamica ora funziona. Questo è uno strumento per estrarre caratteristiche statiche e dinamiche da APK Android. Combina diversi strumenti noti di analisi di app Android come DroidBox, FlowDroid, Strace, AndroGuard o...

MARA_Framework

MARAFramework MARA ist ein M obile A pplication R everse Engineering und A nalyse-Framework. Es ist ein Tool, das häufig verwendete Tools für Reverse Engineering und Analyse von mobilen Anwendungen zusammenbringt, um das Testen mobiler Anwendungen auf die OWASP mobile security threats zu...

Andromeda

Andromeda rende il lavoro iniziale di reverse engineering delle applicazioni Android un po' più veloce e facile. Rispetto ad altre alternative, è scritto in C/C++ e ha un notevole vantaggio in termini di prestazioni. DEMO Lo strumento è in fase di sviluppo iniziale Building Requisiti clang: apt...

Apkatshu

Apkatshu Apkatshu è uno strumento per estrarre URL, email, indirizzi IP e dati interessanti da file APK root@kitploit: Apkatshu : tool written in bash/python for extracting urls, emails, ip addresses, and interesting data from APK files. The user can choose either JADX or APKTOOL for...

Android-Disassembler

Android-Disassembler CodeFactor Analysieren Sie bösartige Apps auf Ihrem Telefon Wartungsstatus Die Wartung wurde wieder aufgenommen, aber das Projekt befindet sich noch in einer Wiederherstellungs- und Modernisierungsphase. Die Basis erwartet nun initialisierte Git-Submodule vor dem Build...

YAASA

YAASA YAASA Yet Another APK Static Analyzer è un framework per divertirsi analizzando APK. Il progetto utilizza i seguenti strumenti ed è basato sul framework Django: APKTool: Uno strumento per il reverse engineering dei file apk Android AxmlParserPY: AxmlParser in Python PlagueScanner: Framework...

BFScan

BFScan Strumento per l'elaborazione iniziale di applicazioni APK / XAPK / APKM / DEX / JAR / WAR. Ricerca di stringhe nel codice sorgente e nelle risorse che assomigliano a URI, percorsi o segreti Genera richieste HTTP grezze e specifiche OpenAPI basate su file di configurazione, annotazioni di...

slicer

Slicer A tool to automate the recon process on an APK file. Slicer accepts a path to an extracted APK file and then returns all the activities, receivers, and services which are exported and have null permissions and can be externally provoked. Note : The APK has to be extracted via jadx or...

httptoolkit

HTTP Toolkit...

MobSF has SSRF port restriction bypass in assetlinks_check

Summary MobSF's Android App Link assetlinks checker validates only the manifest android:host value with validhost, but then appends the separate android:port value into the URL used for the server-side request. This bypasses the current port restriction in validhost and lets a crafted APK cause...

PYSEC-2026-1675 Mobile Security Framework (MobSF) Allows Stored Cross Site Scripting (XSS) via malicious SVG Icon Upload

Vulnerable MobSF Versions: .svg This file becomes publicly accessible via the web interface at: http://127.0.0.1:8081/download/filename.svg If the SVG contains embedded JavaScript e.g., an XSS payload, accessing this URL via a browser leads to the execution of the script in the context of the Mob...

Exploit for Race Condition in Canonical Ubuntu_Linux

Dillu-Analyzer 🛡️ Dillu Analyzer — A web-based universal malwa...

EUVD-2025-13371

Malicious code in bioql PyPI...

Cross-site Scripting (XSS)

mobsf is vulnerable to Stored Cross-Site Scripting XSS. The vulnerability is due to improper input sanitization during SVG file handling in the Android APK analysis workflow, which allows malicious scripts to be embedded in the SVG files...

CVE-2025-46335

Mobile Security Framework MobSF is a security research platform for mobile applications in Android, iOS and Windows Mobile. A Stored Cross-Site Scripting XSS vulnerability has been identified in MobSF versions up to and including 4.3.2. The vulnerability arises from improper sanitization of...

CVE-2025-46335

Mobile Security Framework MobSF is a security research platform for mobile applications in Android, iOS and Windows Mobile. A Stored Cross-Site Scripting XSS vulnerability has been identified in MobSF versions up to and including 4.3.2. The vulnerability arises from improper sanitization of...