mobile-security

The OWASP Mobile Application Security Testing Guide (MASTG) is a comprehensive manual for mobile app security testing and reverse engineering. It describes technical processes for verifying the OWASP Mobile Security Weakness Enumeration (MASWE) weaknesses, which are in alignment with the OWASP MASVS.

Android Full-Stack Device Control Platform: WebRTC/H.264 remote desktop, UI/OCR/image-matching automation, one-click MITM, built-in Frida, proxy/VPN/frp/P2P networking, MCP/Agent, 160+ APIs, designed for multi-device clusters and engineered deployments.

Scanning APK file for URIs, endpoints & secrets.

the fastest and most powerful android decompiler(native tool working without Java VM) for the APK, DEX, ODEX, OAT, JAR, AAR, and CLASS file. which supports malicious behavior detection, privacy leaking detection, vulnerability detection, path solving, packer identification, variable tracking, deobfuscation, python&java scripts, device memory ext…

Flutter Reverse Engineering Framework

Flutter Reverse Engineering Framework

Android security insights in full spectrum.

MCP server for JADX-AI Plugin

Build anti-detection Frida server from source. ~90 patches covering 16 detection vectors, weekly auto-builds with random names.

Flutter SSL Pinning Bypass Tool for Android & iOS — works on any Flutter version without pattern databases

Django application that performs SAST and Malware Analysis for Android APKs

Modern offline-first Application Security Intelligence Platform for Android, iOS, Flutter and React Native with attack-chain analysis, explainable findings, source exploration, AI-assisted investigation and professional reporting.

面向移动安全分析场景的 6 阶段总控 Skill。用于统一调度 APK 静态侦察、流量与代码对齐、SO/JNI 深度分析、加密与漏洞综合分析、验证设计与报告交付流程。支持 JADX MCP、Burp/Yakit MCP、IDA/Ghidra MCP。

Robust Frida-based tool to dump decrypted iOS apps as .ipa from a jailbroken device supports App Store, sideloaded and system.

LLMs have ended reverse engineering as a high-barrier skill. Case study: reconstructing 6/7 custom HTTP signing parameters of Douyin (TikTok CN) v38.1.0 native library in 30 days using Claude Opus. 大型语言模型（LLMs）已经终结了“逆向工程是一项高门槛技能”的时代。案例研究：使用 Claude Opus，在 30 天内成功还原抖音（中国版 TikTok）v38.1.0 原生库中 7 个自定义 HTTP 签名参数中的 6 个。

`Linux` `Python` `Cellular` `Monitoring` - Cell tower logger and anomaly detector for Linux mobile devices. Monitors cellular connections, logs tower data with GPS, and detects suspicious activity.

Cloning apk for bypassing code tampering detection, Google Safety Net and scanning vulnerable plugins

GSM Assessment Toolkit - A security evaluation framework for GSM networks

Automated Firebase recon and security scanner. Extracts from APKs, IPAs or web and checks for unauthorized read and write access on Firestore, Realtime Database, Storage buckets, Remote Config, Cloud Functions, and detects hardcoded service account keys.

DroidXploit – An all-in-one Android security assessment framework for rooted emulators, providing a modular CLI for enumeration, runtime analysis, and exploitation research.