107 entries
| Tool | Description | Section | Links | Last Updated |
|---|---|---|---|---|
| adbsource.android.com | Allows you to install packages and evaluate your changes. | App/File ManagementOffensive Security | — | |
| Airdroidairdroid.com | Transfer files across devices, remote control Android devices, mirror screen, and manage SMS & notification on computer. | App/File ManagementOffensive Security | — | |
| Android APK Decompilerdecompileandroid.com | Online android decompiler. | Online ServicesOffensive Security | — | |
| Android Application Penetration Testing Checklistxmind.net | Android pentesting checklist mindmap. | Guides & ReferencesOffensive Security | — | |
| Android Checknoveogroup/android-check | Static code analysis plugin for Android project. | Static AnalysisOffensive Security | GitHub★ 265 |
8y ago |
| Android File Transferandroid.com | Browse and transfer files between your Mac computer and your Android device. | App/File ManagementOffensive Security | — | |
| Android Reports & ReportsB3nac/Android-Reports-and-Resources | Android reports and resources. | Bug Bounty ReportsOffensive Security | GitHub★ 1.7k |
4d ago |
| Androwarnmaaaaz/androwarn | Static code analyzer for malicious Android applications. | Static AnalysisOffensive Security | GitHub★ 535 |
6y ago |
| APK Studiovaibhavpandeyvpz/apkstudio | The objective of this scanner is to find for misconfiguration, sensitive data and insecure components. | Static AnalysisOffensive Security | GitHub★ 4.7k |
9mo ago |
| APKLabAPKLab/APKLab | A tool for reverse engineering 3rd party, closed, binary Android apps. | Static AnalysisOffensive Security | GitHub★ 4k |
3mo ago |
| APKLeaksdwisiswant0/apkleaks | Scanning APK file for URIs, endpoints & secrets. | Static AnalysisOffensive Security | GitHub★ 6.4k |
1y ago |
| APKToolibotpeaches.github.io | Seamlessly integrates the best open-source tools right inside VS Code. | Static AnalysisOffensive Security | — | |
| AppUseappsec-labs.com | Mobile app security testing, Android and iOS applications. Custom-made tools and scripts created by AppSec Labs. | VirtualizationOffensive Security | — | |
| Argus-SAFarguslab/Argus-SAF | Static analysis framework. | Static AnalysisOffensive Security | GitHub★ 199 |
3y ago |
| B3nac Secyoutube.com | Dedicated mobile ethical hacking. | Video ContentOffensive Security | — | |
| bfdecryptBishopFox/bfdecrypt | Utility to decrypt App Store apps on jailbroken iOS 11.x. | Reverse EngineeringOffensive Security | GitHub★ 493 |
6y ago |
| BinaryCookieReaderas0ler/BinaryCookieReader | A tool to read the binarycookie format of Cookies on iOS applications. | Post Exploitation (iOS)Offensive Security | GitHub★ 105 |
2y ago |
| Bytecode Viewerkonloch/bytecode-viewer | A lightweight user friendly Java Bytecode Viewer. | Dynamic AnalysisOffensive Security | GitHub★ 15.7k |
3mo ago |
| canijailbreakcanijailbreak.com | A website which tells you whether you can jailbreak your iOS device. | Jailbreaking & Rooting | — | |
| Checkra1ncheckra.in | Jailbreak for iPhone 5s through iPhone X, iOS 12.0 and up. | Jailbreaking & Rooting | — | |
| Checkstylecheckstyle/checkstyle | A tool for checking Java source code for adherence to a Code Standard or set of validation rules. | Static AnalysisOffensive Security | GitHub★ 9.6k |
1d ago |
| Chimerachimera.coolstar.org | iOS 12 jailbreak to not only feature a CoreTrust bypass so that binaries don't need to be resigned, but to also support A12 devices, including iPhone Xs, iPhone Xr, and the newest iPads. | Jailbreaking & Rooting | — | |
| ClassDumpiOSDreamDevLost/classdumpios | iOS port from nygard/class-dump. | Post Exploitation (iOS)Offensive Security | GitHub★ 46 |
5y ago |
| ClutchKJCracks/Clutch | Fast iOS executable dumper. | Reverse EngineeringOffensive Security | GitHub★ 3.8k |
1y ago |
| CuckooDroididanr1986/cuckoo-droid | Automated Android Malware Analysis with Cuckoo Sandbox. | Dynamic AnalysisOffensive Security | GitHub★ 609 |
5y ago |
| Cycriptas0ler/BinaryCookieReader | Explore and modify running applications on either iOS or Mac OS X using a hybrid of Objective-C++ and JavaScript. | Post Exploitation (iOS)Offensive Security | 2y ago | |
| Cydia Impactorcydiaimpactor.com | Use this tool to install IPA files on iOS and APK files on Android. | Flashing/SideloadingOffensive Security | — | |
| DECAFdecaf-project/DECAF | DECAF (short for Dynamic Executable Code Analysis Framework) is a binary analysis platform based on QEMU. | Dynamic AnalysisOffensive Security | GitHub★ 840 |
1y ago |
| DeoptfuscatorGyoonus/deoptfuscator | Reverse the control-flow obfuscation performed by DexGuard on open-source Android applications. | Static AnalysisOffensive Security | GitHub★ 481 |
4y ago |
| DexGuardguardsquare.com | The full spectrum of protection for Android apps. | Source Code ObfuscationDefensive Security | — | |
| Diggys0md3v/Diggy | Extract endpoints from apk files. | Dynamic AnalysisOffensive Security | GitHub★ 871 |
Archived |
| DIVAdecompileandroid.com | DIVA (Damn insecure and vulnerable App) is an Android App intentionally designed to be insecure. | Labs/PracticeOffensive Security | — | |
| dmesgDreamDevLost/classdumpios | Prints Android kernel messages. Already installed on device. | Post Exploitation (Android)Offensive Security | GitHub★ 46 |
5y ago |
| Double H3lixdoubleh3lix.tihmstar.net | Jailbreak for 64-bit 10.x devices. | Jailbreaking & Rooting | — | |
| Droid-FFantojoseph/droid-ff | The android fuzzing framework. | Dynamic AnalysisOffensive Security | GitHub★ 88 |
26d ago |
| Droid-Hunterhahwul/droid-hunter | Android application vulnerability analysis and Android pentest tool. | Static AnalysisOffensive Security | GitHub★ 312 |
Archived |
| DrozerFSecureLABS/drozer | Security testing framework for Android. | Dynamic AnalysisOffensive Security | GitHub★ 4.6k |
6mo ago |
| DumpDecryptedstefanesser/dumpdecrypted | Dumps decrypted mach-o files from encrypted iPhone applications from memory to disk. | Post Exploitation (iOS)Offensive Security | GitHub★ 3k |
9y ago |
| Dumpsysdeveloper.android.com | a tool that runs on Android devices and provides information about system services. Already installed on device. | Post Exploitation (Android)Offensive Security | — | |
| DVHMAlogicalhacking/DVHMA | Damn Vulnerable Hybrid Mobile App (DVHMA) is a hybrid mobile app (for Android) that intentionally contains vulnerabilities. | Labs/PracticeOffensive Security | GitHub★ 274 |
8y ago |
| EggShellneoneggplant/EggShell | iOS/macOS/Linux Remote Administration Tool. | Post Exploitation (Android)Offensive Security | GitHub★ 1.8k |
5y ago |
| Error Pronegoogle/error-prone | Error Prone is a static analysis tool for Java that catches common programming mistakes at compile-time. | Static AnalysisOffensive Security | GitHub★ 7.3k |
2d ago |
| Etasonetasonjb.tihmstar.net | Jailbreak for all devices running iOS 8.4.1 32 bit. | Jailbreaking & Rooting | — | |
| Find Security Bugsfind-sec-bugs/find-sec-bugs | Find Security Bugs is the SpotBugs plugin for security audits of Java web applications. | Static AnalysisOffensive Security | GitHub★ 2.5k |
6d ago |
| FindBugsfindbugs.sourceforge.net | Uses static analysis to inspect Java bytecode for occurrences of bug patterns. | Static AnalysisOffensive Security | — | |
| flexdecryptJohnCoates/flexdecrypt | Decrypt iOS Apps and Mach-O binaries. | Reverse EngineeringOffensive Security | GitHub★ 742 |
3y ago |
| FlowDroidsecure-software-engineering/FlowDroid | Statically computes data flows in Android apps and Java programs. | Static AnalysisOffensive Security | GitHub★ 1.3k |
27d ago |
| FoulDecryptNyaMisty/fouldecrypt | A lightweight and simpling iOS binary decryptor. | Reverse EngineeringOffensive Security | GitHub★ 319 |
2y ago |
| Fridafrida/frida | Dynamic instrumentation toolkit for developers, reverse-engineers, and security researchers. | Dynamic AnalysisOffensive Security | GitHub★ 22.4k |
2d ago |
| Gradlenovoda/gradle-static-analysis-plugin | Supports many popular static analysis (Checkstyle, PMD, FindBugs, etc) via a set of built-in plugins. | Static AnalysisOffensive Security | GitHub★ 403 |
Archived |
| H3lixh3lix.tihmstar.net | Jailbreak for 32-bit 10.x devices. | Jailbreaking & Rooting | — | |
| Home Depotwall.supplies | Jailbreak for iOS 9.x devices. | Jailbreaking & Rooting | — | |
| HookerAndroidHooker/hooker | Provides various tools and applications that can be use to automatically intercept and modify any API calls. | Dynamic AnalysisOffensive Security | GitHub★ 415 |
Archived |
| Housenccgroup/house | A runtime mobile application analysis toolkit with a Web GUI, powered by Frida, written in Python. | Dynamic AnalysisOffensive Security | GitHub★ 1.5k |
5y ago |
| iExplorermacroplant.com | Transfers music, messages, photos, files and everything else. | App/File ManagementOffensive Security | — | |
| iFunboxi-funbox.com | General file management software for iPhone and other Apple products. | App/File ManagementOffensive Security | — | |
| iMazingimazing.com | Powerful user-friendly iOS device manager for Mac and PC. | App/File ManagementOffensive Security | — | |
| Inferfacebook/infer | Infer is a static analysis tool for Java, C++, Objective-C, and C. Infer is written in OCaml. | Static AnalysisOffensive Security | GitHub★ 15.7k |
2d ago |
| Injured AndroidB3nac/InjuredAndroid | A vulnerable Android application that shows simple examples of vulnerabilities in a ctf style. | Labs/PracticeOffensive Security | GitHub★ 762 |
Archived |
| InsecureBank v2dineshshetty/Android-InsecureBankv2 | Vulnerable Android application for developers and security enthusiasts to learn about Android insecurities. | Labs/PracticeOffensive Security | GitHub★ 1.5k |
2y ago |
| Inspeckageac-pm/Inspeckage | Tool developed to offer dynamic analysis of Android applications. | Dynamic AnalysisOffensive Security | GitHub★ 3k |
6y ago |
| iOS Pentestingmindmeister.com | iOS pentesting mindmap. | Guides & ReferencesOffensive Security | — | |
| IPSWipsw.me | Download current and previous versions of Apple's iOS, iPadOS, watchOS, tvOS and audioOS firmware and receive notifications when new firmwares are released. | Jailbreaking & Rooting | — | |
| JADXskylot/jadx | Dex to Java decompiler. | Static AnalysisOffensive Security | GitHub★ 51.3k |
1d ago |
| jarsignerJamling/jarsigner | Jar, Android apk, Eclipse RCP signer. | Post Exploitation (Android)Offensive Security | GitHub★ 9 |
8y ago |
| keystore-explorerkaikramer/keystore-explorer | GUI replacement for the Java command-line utilities keytool and jarsigner. | Post Exploitation (Android)Offensive Security | GitHub★ 2.1k |
1d ago |
| KToolKritantaDev/ktool | Cross-platform MachO/ObjC Static binary analysis tool & library. class-dump + otool + lipo + more. | Post Exploitation (iOS)Offensive Security | GitHub★ 525 |
7mo ago |
| Magisktopjohnwu/Magisk | Magisk is a suite of open source software for customizing Android, supporting devices higher than Android 5.0. | Jailbreaking & Rooting | GitHub★ 63.5k |
1d ago |
| Mobile Auditmpast/mobileAudit | SAST and Malware Analysis for Android Mobile APKs. | Static AnalysisOffensive Security | GitHub★ 229 |
1d ago |
| MobileAssistantportswigger.net | A tool to facilitate testing of iOS apps with Burp Suite. | Post Exploitation (iOS)Offensive Security | — | |
| MobSFMobSF/Mobile-Security-Framework-MobSF | An automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework. | Dynamic AnalysisOffensive Security | GitHub★ 22k |
1d ago |
| NeedleFSecureLABS/needle | The iOS Security Testing Framework. | Post Exploitation (iOS)Offensive Security | GitHub★ 1.4k |
Archived |
| Objectionatomicobject/objection | A lightweight dependency injection framework for Objective-C. | Post Exploitation (iOS)Offensive Security | GitHub★ 1.8k |
9y ago |
| Odinodindownload.com | Used to flash a custom recovery firmware image to a Samsung Android device. | Flashing/SideloadingOffensive Security | — | |
| Ostorlabostorlab.co | Online static taint analysis, 3rd party fingerprinting, and vulnerability analysis. | Online ServicesOffensive Security | — | |
| Oversecuredoversecured.com | Android mobile app analyzer vulnerability scanner, designed for DevOps process integration. | Online ServicesOffensive Security | — | |
| Oversecured Vulnerable Android Appoversecured/ovaa | An Android app that aggregates all the platform's known and popular security vulnerabilities. | Labs/PracticeOffensive Security | GitHub★ 766 |
19d ago |
| p0sixspwnih8sn0w.com | iOS Jailbreak for 6.1.X. | Jailbreaking & Rooting | — | |
| Palra1npalera1n/palera1n | Jailbreak for arm64 devices on iOS 15.0+. | Jailbreaking & Rooting | GitHub★ 6.6k |
7d ago |
| PATDroidmingyuan-xia/PATDroid | A collection of tools and data structures for analyzing Android applications and the system itself. | Dynamic AnalysisOffensive Security | GitHub★ 120 |
9y ago |
| Phoenixphoenixpwn.com | Semi-untethered jailbreak for 9.3.5-9.3.6. All 32-bit devices supported. | Jailbreaking & Rooting | — | |
| Plistsubtractorjoswr1ght/plistsubtractor | Read a plist file, write out any embedded plist files. | Post Exploitation (Android)Offensive Security | GitHub★ 36 |
10y ago |
| PMDpmd/pmd | Finds common programming flaws like unused variables, empty catch blocks, unnecessary object creation, and so forth. | Static AnalysisOffensive Security | GitHub★ 5.5k |
2d ago |
| ProbeDroidZSShen/ProbeDroid | A dynamic Java code instrumentation for Android apps. Provides APIs for users to craft their own instrumentation tools. | Dynamic AnalysisOffensive Security | GitHub★ 204 |
7y ago |
| ProxyDroidmadeye/proxydroid | Global Proxy for Android. | Post Exploitation (Android)Offensive Security | GitHub★ 2.6k |
5mo ago |
| Qarklinkedin/qark | designed to look for several security related Android application vulnerabilities, either in source code or packaged APKs. | Static AnalysisOffensive Security | GitHub★ 3.4k |
2y ago |
| Quarkquark-engine/quark-engine | An Obfuscation-Neglect Android Malware Scoring System. | Static AnalysisOffensive Security | GitHub★ 1.7k |
2d ago |
| Quixxiquixxisecurity.com | An intelligent and integrated end-to-end mobile app security solution. | Online ServicesOffensive Security | — | |
| r2flutchas0ler/r2flutch | Tool to decrypt iOS apps using r2frida. | Reverse EngineeringOffensive Security | GitHub★ 184 |
1mo ago |
| redsn0wipsw.me | Jailbreak for iOS 3-5. | Jailbreaking & Rooting | — | |
| Runtime Mobile Security (RMS)m0bilesecurity/RMS-Runtime-Mobile-Security | Powered by FRIDA a powerful web interface that helps you to manipulate Android and iOS Apps at Runtime. | Dynamic AnalysisOffensive Security | GitHub★ 3.1k |
13d ago |
| RVICTLgh2o/rvi_capture | Capture packets sent/received by iOS devices. | Post Exploitation (iOS)Offensive Security | GitHub★ 217 |
2y ago |
| Sileogetsileo.app | A fast, beautiful, powerful and efficient APT Package Manager designed for jailbroken device. | Post Exploitation (iOS)Offensive Security | — | |
| SimplifyCalebFenton/simplify | Android virtual machine and deobfuscator. | Post Exploitation (Android)Offensive Security | GitHub★ 4.7k |
4y ago |
| SmaliJesusFreke/smali | An assembler/disassembler for the dex format used by dalvik, Android's Java VM implementation. | Static AnalysisOffensive Security | GitHub★ 6.6k |
Archived |
| Sootsoot-oss/soot | Smali Control Flow Graph's. | Static AnalysisOffensive Security | GitHub★ 3.1k |
13d ago |
| Spartatypetools/sparta | Static program analysis for reliable trusted apps. | Static AnalysisOffensive Security | GitHub★ 24 |
7y ago |
| SSLKillSwitchiSECPartners/ios-ssl-kill-switch | Blackbox tool to disable SSL certificate validation. | Post Exploitation (iOS)Offensive Security | GitHub★ 917 |
5y ago |
| SSLKillSwitch2nabla-c0d3/ssl-kill-switch2 | Blackbox tool to disable SSL certificate validation. | Post Exploitation (iOS)Offensive Security | GitHub★ 3.3k |
3y ago |
| StaCoAnvincentcox/StaCoAn | A crossplatform tool which aids developers, bugbounty hunters and ethical hackers performing static code analysis on mobile applications. | Static AnalysisOffensive Security | GitHub★ 870 |
5y ago |
| Trueseeingmonolithworks/trueseeing | A fast, accurate and resilient vulnerability scanner for Android apps. | Static AnalysisOffensive Security | GitHub★ 2 |
2y ago |
| unc0verunc0ver.dev | A jailbreak tool. | Jailbreaking & Rooting | — | |
| UnCrackable AppsOWASP/owasp-mstg | A collection of mobile reverse engineering challenges for iOS and Android. | Labs/PracticeOffensive Security | GitHub★ 13.3k |
1d ago |
| Vuldroidjaiswalakshansh/Vuldroid | Vuldroid is a Vulnerable Android Application made with security issues in order to demonstrate how they can occur in code. | Labs/PracticeOffensive Security | GitHub★ 68 |
5y ago |
| VyAPIappsecco/VyAPI | The Modern Cloud-Based Vulnerable Hybrid Android App. | Labs/PracticeOffensive Security | GitHub★ 84 |
6y ago |
| WaTF-BankWaTF-Team/WaTF-Bank | What a Terrible Failure Mobile Banking Application for Android and iOS. | Labs/PracticeOffensive Security | GitHub★ 145 |
4y ago |
| Yaazhinivegabird.com | Vulnerability scanner for Android APKs and their APIs. | Static AnalysisOffensive Security | — |
Nothing matches that filter. Suggest a tool?