android-security-awesome.md

android-security-awesome

A collection of android security related resources.

A lot of work is happening in academia and industry on tools to perform dynamic analysis, static analysis and reverse engineering of android apps.

ONLINE ANALYZERS

1. AndroTotal
2. Dexter
3. Tracedroid
4. Visual Threat
5. Mobile Malware Sandbox
6. MobiSec Eacus
7. IBM Security AppScan Mobile Analyzer - not free
8. NVISO ApkScan
9. AVC UnDroid
10. Fireeye - max 60MB 15/day
11. habo 10/day
12. Virustotal -max 128MB
13. Fraunhofer App-ray - not free
14. ~~ CopperDroid ~~
15. ~~ SandDroid ~~
16. ~~ Stowaway ~~
17. ~~ Anubis ~~
18. ~~ Mobile app insight ~~
19. ~~ Mobile-Sandbox ~~
20. ~~ Ijiami ~~
21. ~~ Comdroid ~~
22. ~~ Android Sandbox ~~
23. ~~ Foresafe ~~

STATIC ANALYSIS TOOLS

1. Androwarn - detect and warn the user about potential malicious behaviours developped by an Android application.
2. ApkAnalyser ^{★ 654, pushed 1270 days ago}
3. APKInspector
4. Droid Intent Data Flow Analysis for Information Leakage
5. DroidLegacy
6. Several tools from PSU
7. Smali CFG generator ^{★ 33, pushed 793 days ago}
8. FlowDroid
9. Android Decompiler – not free
10. PSCout - A tool that extracts the permission specification from the Android OS source code using static analysis
11. Amandroid
12. SmaliSCA - Smali Static Code Analysis ^{★ 139, pushed 360 days ago}
13. CFGScanDroid - Scans and compares CFG against CFG of malicious applications ^{★ 15, pushed 468 days ago}
14. Madrolyzer - extracts actionable data like C&C, phone number etc. ^{★ 42, pushed 487 days ago}
15. SPARTA - verifies (proves) that an app satisfies an information-flow security policy; built on the Checker Framework
16. ConDroid - Performs a combination of symoblic + concrete execution of the app ^{★ 2, pushed 181 days ago}

APP VULNERABILITY SCANNERS

1. QARK - QARK by LinkedIn is for app developers to scan app for security issues
2. AndroBugs ^{★ 224, pushed 298 days ago}
3. Nogotofail

DYNAMIC ANALYSIS TOOLS

1. Android DBI frameowork
2. Androl4b - A Virtual Machine For Assessing Android applications, Reverse Engineering and Malware Analysis ^{★ 172, pushed 212 days ago}
3. Android Malware Analysis Toolkit - (linux distro) Earlier it use to be an online analyzer
4. Mobile-Security-Framework MobSF - Mobile Security Framework is an intelligent, all-in-one open source mobile application (Android/iOS) automated pen-testing framework capable of performing static, dynamic analysis and web API testing.
5. AppUse – custom build for pentesting
6. Cobradroid – custom image for malware analysis
7. ViaLab Community Edition
8. Droidbox ^{★ 148, pushed 346 days ago}
9. Mercury
10. Drozer
11. Xposed - equivalent of doing Stub based code injection but without any modifications to the binary
12. Android Hooker - Dynamic Java code instrumentation (requires the Substrate Framework) ^{★ 192, pushed 221 days ago}
13. ProbeDroid - Dynamic Java code instrumentation
14. Android Tamer - Virtual / Live Platform for Android Security Professionals
15. DECAF - Dynamic Executable Code Analysis Framework based on QEMU (DroidScope is now an extension to DECAF)
16. CuckooDroid - Android extension for Cuckoo sandbox ^{★ 130, pushed 339 days ago}
17. Mem - Memory analysis of Android (root required) ^{★ 16, pushed 451 days ago}
18. Crowdroid – unable to find the actual tool
19. AuditdAndroid – android port of auditd, not under active development anymore ^{★ 23, pushed 1215 days ago}
20. Android Security Evaluation Framework - not under active development anymore
21. Android Reverse Engineering – ARE (android reverse engineering) not under active development anymore
22. Aurasium – Practical security policy enforcement for Android apps via bytecode rewriting and in-place reference monitor. ^{★ 12, pushed 596 days ago}
23. Android Linux Kernel modules ^{★ 54, pushed 724 days ago}
24. Appie - Appie is a software package that has been pre-configured to function as an Android Pentesting Environment.It is completely portable and can be carried on USB stick or smartphone.This is a one stop answer for all the tools needed in Android Application Security Assessment and an awesome alternative to existing virtual machines.
25. StaDynA - a system supporting security app analysis in the presence of dynamic code update features (dynamic class loading and reflection). This tool combines static and dynamic analysis of Android applications in order to reveal the hidden/updated behavior and extend static analysis results with this information. ^{★ 2, pushed 526 days ago}
26. DroidAnalytics - incomplete ^{★ 14, pushed 481 days ago}
27. Vezir Project - Virtual Machine for Mobile Application Pentesting and Mobile Malware Analysis ^{★ 29, pushed 133 days ago}
28. MARA - Mobile Application Reverse engineering and Analysis Framework
29. ~~ Taintdroid ~~ - requires AOSP compilation

REVERSE ENGINEERING

1. Smali/Baksmali – apk decompilation ^{★ 801, pushed 134 days ago}
2. emacs syntax coloring for smali files ^{★ 17, pushed 151 days ago}
3. vim syntax coloring for smali files
4. AndBug ^{★ 289, pushed 693 days ago}
5. Androguard – powerful, integrates well with other tools ^{★ 905, pushed 167 days ago}
6. Apktool – really useful for compilation/decompilation (uses smali)
7. Android Framework for Exploitation ^{★ 93, pushed 344 days ago}
8. Bypass signature and permission checks for IPCs ^{★ 27, pushed 991 days ago}
9. Android OpenDebug – make any application on device debuggable (using cydia substrate). ^{★ 34, pushed 996 days ago}
10. Dare – .dex to .class converter
11. Dex2Jar - dex to jar converter ^{★ 1628, pushed 134 days ago}
12. Enjarify - dex to jar converter from Google ^{★ 1314, pushed 133 days ago}
13. Dedexer
14. Fino ^{★ 64, pushed 681 days ago}
15. Frida - inject javascript to explore applications and a GUI tool for it
16. Indroid – thread injection kit
17. IntentSniffer
18. Introspy ^{★ 192, pushed 966 days ago}
19. Jad - Java decompiler
20. JD-GUI - Java decompiler ^{★ 1781, pushed 165 days ago}
21. CFR - Java decompiler
22. Krakatau - Java decompiler ^{★ 527, pushed 129 days ago}
23. Procyon - Java decompiler
24. FernFlower - Java decompiler ^{★ 451, pushed 132 days ago}
25. Redexer – apk manipulation ^{★ 66, pushed 172 days ago}
26. Smali viewer
27. ~~ ZjDroid ~~, ~~ fork/mirror ~~
28. Simplify Android deobfuscator ^{★ 403, pushed 165 days ago}
29. Bytecode viewer ^{★ 1095, pushed 176 days ago}
30. Radare2 ^{★ 2602, pushed 126 days ago}

FUZZ TESTING

1. IntentFuzzer
2. Radamsa Fuzzer ^{★ 16, pushed 229 days ago}
3. Honggfuzz ^{★ 263, pushed 128 days ago}
4. An Android port of the melkor ELF fuzzer ^{★ 31, pushed 746 days ago}
5. Media Fuzzing Framework for Android ^{★ 139, pushed 157 days ago}
6. AndroFuzz

APP REPACKAGING DETECTORS

1. FSquaDRA - a tool for detection of repackaged Android applications based on app resources hash comparison. ^{★ 23, pushed 196 days ago}

EXPLOITABLE VULNERABILITIES

1. Vulnerability Google Doc
2. Root Exploits (from Drozer issue #56)

SAMPLE SOURCES

1. Contagio Mini Dump
2. Android Malware Github repo ^{★ 1, pushed 130 days ago}
3. Open Source database
4. Drebin
5. Admire
6. MalGenome - contains 1260 malware samples categorized into 49 different malware families, free for research purpose.
7. VirusTotal Malware Intelligence Service - powered by VirusTotal,not free

READING MATERIAL

1. Android Security (and Not) Internals
2. Android security related presentations ^{★ 47, pushed 659 days ago}
3. A good collection of static analysis papers

MARKET CRAWLERS

1. Google play crawler (Java) ^{★ 242, pushed 940 days ago}
2. Google play crawler (Python) ^{★ 489, pushed 336 days ago}
3. Google play crawler (Node) - get app details and download apps from official Google Play Store. ^{★ 36, pushed 157 days ago}
4. Aptoide downloader (Node) - download apps from Aptoide third-party Android market ^{★ 9, pushed 402 days ago}
5. Appland downloader (Node) - download apps from Appland third-party Android market ^{★ 3, pushed 403 days ago}

MISC TOOLS

1. smalihook
2. APK-Downloader
3. AXMLPrinter2 - to convert binary XML files to human-readable XML files
4. adb autocomplete
5. Dalvik opcodes
6. Opcodes table for quick reference
7. ExploitMe Android Labs - for practice
8. GoatDroid - for practice ^{★ 116, pushed 769 days ago}
9. mitmproxy ^{★ 4870, pushed 125 days ago}
10. dockerfile/androguard ^{★ 18, pushed 182 days ago}
11. Android Vulnerability Test Suite - android-vts scans a device for set of vulnerabilities ^{★ 676, pushed 137 days ago}

TUTORIALS

1. Android Reverse Engineering 101 by Daniele Altomare

Other Awesome Lists

Other amazingly awesome lists can be found in the awesome-awesomeness list.

Contributing

Your contributions are always welcome!