32 matches found
Apkatshu
Apkatshu Apkatshu its a Tool for extracting urls , emails , ip address , and interesting data from APK files Apkatshu : tool written in bash/python for extracting urls, emails, ip addresses, and interesting data from APK files. The user can choose either JADX or APKTOOL for de-compilation. USAGE ...
jadx-ai-mcp
JADX-AI-MCP Part of Zin MCP Suite ā” Fully automated MCP server + JADX plugin built to communicate with LLM through MCP to analyze Android APKs using LLMs like Claude ā uncover vulnerabilities, analyze APK, and reverse engineer effortlessly. ā Contributors Thanks to these wonderful people for thei...
slicer
Slicer A tool to automate the recon process on an APK file. Slicer accepts a path to an extracted APK file and then returns all the activities, receivers, and services which are exported and have null permissions and can be externally provoked. Note : The APK has to be extracted via jadx or...
android-security-awesome
android-security-awesome A collection of Android security-related resources. If you find this project useful, please consider supporting it. 1. Tools 2. Academic/Research/Publications/Books 3. Exploits/Vulnerabilities/Bugs Tools Online Analyzers 1. Appknox - not free 2. Virustotal 3. NowSecure La...
AndroPyTool
AndroPyTool Update! DroidBox images were fixed. Dynamic analysis is working now. This is a tool for extracting static and dynamic features from Android APKs. It combines different well-known Android apps analysis tools such as DroidBox, FlowDroid, Strace, AndroGuard or VirusTotal analysis. Provid...
Android-Disassembler
Android-Disassembler !ci12 CodeFactor Analyze malicious app on your phone Maintenance status Maintenance has resumed, but the project is still in a recovery and modernization phase. The baseline now expects initialized git submodules before building. Default open/import/export flows now use...
httptoolkit
HTTP Toolkit !HTTP Toolkit has received funding from NLnet as part of NGI Zero...
Artemis
Artemis Overview A tools for Find APK Infrastructure . Brought to you by: HADESS performs offensive cybersecurity services through infrastructures and software that include vulnerability analysis, scenario attack planning, and implementation of custom integrated preventive projects. We organized...
BFScan
BFScan Herramienta para el procesamiento inicial de aplicaciones APK / XAPK / APKM / DEX / JAR / WAR. Busca cadenas en el cĆ³digo fuente y los recursos que parezcan URI, rutas o secretos Genera solicitudes HTTP sin procesar y especificaciones OpenAPI basadas en archivos de configuraciĆ³n, anotacion...
androwarn
Androwarn Yet another static code analyzer for malicious Android applications Description Androwarn is a tool whose main aim is to detect and warn the user about potential malicious behaviours developped by an Android application. The detection is performed with the static analysis of the...
awesome-android-security
Awesome-Android-Security ē®å½ å客 ęä½ęå č®ŗę 书ē± å¹č® å·„å · éęåęå·„å · åØęåęå·„å · åØēŗæAPKåęåØ åØēŗæAPKåē¼čÆåØ åčÆåęå·„å · å®éŖ室 ę¼č®² ę锹 ę¼ę“čµéäøWriteup éę„č”Ø ę£ę„ęø å ę¼ę“čµéę„å å客 é©å½ę大ē§»åØč天åŗēØäøēäøé®ę¼ę“ å°ē±³č®¾å¤äøåē°ē20äøŖå®å Øé®é¢ ē»čæAndroidäøInstagramåThreadsēSSLčÆ书åŗå® éåå·„ēØAndroidęøøęCoin Hunt Worldåå ¶éäæ”å议仄ä½å¼ åē°Androidäøē¹å®äŗååēę¼ę“ Alien Androidę¶ęč½Æ件ēęęÆåę Androidč®¾å¤ēéå±ē»čæę¼ę“...
YAASA
YAASA YAASA Yet Another APK Static Analyzer is a framework for having fun with analyzing APKs. The project is using the tools below and is built on Django framework: APKTool: A tool for reverse engineering Android apk files AxmlParserPY: Python AxmlParser PlagueScanner: Open source multiple AV...
Andromeda
Andromeda makes initial reverse engineering work of Android applications bit faster and easier. Compared to other alternatives, it's written in C/C++ and has a noticeable performance advantage. DEMO The tool is in the early development stage Building Requirements clang: apt install clang libzip:...
qark
Quick Android Review Kit ę¤å·„å ·ęØåØę„ę¾ Android åŗēØēØåŗäøēå¤äøŖå®å Øēøå ³ę¼ę“ļ¼ę č®ŗęÆęŗ代ē čæęÆęå ē APKćčÆ„å·„å ·čæč½å¤åå»ŗāę¦åæµéŖčÆāåÆéØē½² APK å/ę ADB å½ä»¤ļ¼č½å¤å©ēØå®åē°ēč®øå¤ę¼ę“ćę éåƹęµčÆč®¾å¤čæč” rootļ¼å äøŗę¤å·„å ·äøę³ØäŗåØåę¬å®å ØēēÆå¢äøä»åÆč¢«å©ēØēę¼ę“ć éę± å·²åØ Python 2.7.13 å 3.6 äøęµčÆ å·²åØ OSXćLinux å Windows äøęµčÆ ēØę³ ę“å¤é锹čÆ·åč§ --help å½ä»¤ć APK:: qark --apk path/to/my.apk Java ęŗē ę件:: qark --java...
MobSF has SSRF port restriction bypass in assetlinks_check
Summary MobSF's Android App Link assetlinks checker validates only the manifest android:host value with validhost, but then appends the separate android:port value into the URL used for the server-side request. This bypasses the current port restriction in validhost and lets a crafted APK cause...
PYSEC-2026-1675 Mobile Security Framework (MobSF) Allows Stored Cross Site Scripting (XSS) via malicious SVG Icon Upload
Vulnerable MobSF Versions: .svg This file becomes publicly accessible via the web interface at: http://127.0.0.1:8081/download/filename.svg If the SVG contains embedded JavaScript e.g., an XSS payload, accessing this URL via a browser leads to the execution of the script in the context of the Mob...
Exploit for Race Condition in Canonical Ubuntu_Linux
Dillu-Analyzer š”ļø Dillu Analyzer ā A web-based universal malwa...
EUVD-2025-13371
Malicious code in bioql PyPI...
Cross-site Scripting (XSS)
mobsf is vulnerable to Stored Cross-Site Scripting XSS. The vulnerability is due to improper input sanitization during SVG file handling in the Android APK analysis workflow, which allows malicious scripts to be embedded in the SVG files...
CVE-2025-46335
Mobile Security Framework MobSF is a security research platform for mobile applications in Android, iOS and Windows Mobile. A Stored Cross-Site Scripting XSS vulnerability has been identified in MobSF versions up to and including 4.3.2. The vulnerability arises from improper sanitization of...