Android Security

Explore Android security: secure app development, reverse engineering, vulnerability testing, and best practices for data protection and encryption.

Contact With Me:

Contents

1. Tools
2. Academic / Research / Publications / Books
3. Exploits / Vulnerabilities / Bugs
4. Blogs, Write-ups & Research Feeds
5. Communities, Forums & Conferences

---

Tools

Online Analyzers

Tool	Notes
VirusTotal	Multi-engine scanning, max 128MB per file
Koodous	Static/dynamic malware analysis against public & private YARA rules
MobSF Cloud / Community Edition	Hosted version of the popular open-source MobSF scanner
Oversecured	Enterprise vulnerability scanner for Android & iOS, integrates into CI/CD (paid)
AppSweep by Guardsquare	Free, fast automated security testing for developers
Appknox	Enterprise mobile app security testing platform (paid)
NowSecure	Automated static/dynamic mobile app security testing (paid)
Immuniweb Mobile	OWASP Mobile Top 10 test, privacy check, permissions test — free tier available
Pithus	Open-source APK analyzer with YARA rule hunting

Static Analysis Tools

1. Androguard – powerful reverse engineering and static analysis library, integrates well with other tools
2. MobSF (Mobile Security Framework) – all-in-one static, dynamic, and API pentesting framework for Android/iOS
3. FlowDroid – precise, context/flow/field/object-sensitive taint analysis for Android apps
4. Amandroid – static analysis framework for security vetting of Android apps
5. Quark-Engine – obfuscation-neglect Android malware scoring system
6. APKLeaks – scans APKs for URIs, endpoints & hardcoded secrets
7. Mobile Audit – web app for static analysis & malware detection in APKs
8. ClassyShark – standalone binary inspection tool for any Android executable
9. StaCoAn – cross-platform static code analysis with GUI guidance
10. PSCout – extracts Android permission specification from AOSP source via static analysis
11. SUPER – Secure, Unified, Powerful and Extensible Rust Android Analyzer
12. Trueseeing – fast, automated, static vulnerability scanner and pentesting workbench for Android apps

App Vulnerability Scanners

1. QARK – LinkedIn's tool for scanning apps for security issues
2. AndroBugs Framework – efficient Android vulnerability scanner
3. MobSF – also functions as a full vulnerability scanner (see above)
4. Nogotofail – network traffic security testing tool

Dynamic Analysis Tools

1. Frida – dynamic instrumentation toolkit for injecting scripts into native apps; the industry-standard hooking/tracing tool
2. Objection – Frida-powered runtime mobile exploration toolkit; SSL pinning bypass, filesystem/keychain access, no jailbreak/root required
3. MobSF Dynamic Analyzer – dynamic analysis on emulator/device with API monitoring, traffic capture, and Frida integration
4. Drozer – security testing framework for Android, assesses apps and devices for vulnerabilities
5. Inspeckage – Android package inspector, dynamic analysis with API hooks (Xposed module)
6. House – runtime mobile application analysis toolkit with web GUI, powered by Frida
7. Runtime Mobile Security (RMS) – web UI for manipulating Android/iOS apps at runtime via Frida
8. friTap – intercepts SSL/TLS via Frida, extracts keys and decrypted payload as PCAP in real time
9. AppMon – automated framework for monitoring/tampering with system API calls (Frida-based)
10. MARA Framework – Mobile Application Reverse Engineering and Analysis Framework
11. Xposed Framework – module-based framework for modifying system/app behavior at runtime without touching APKs
12. Android_application_analyzer – analyzes local storage content of Android apps
13. Androl4b – preconfigured VM for Android app assessment, RE, and malware analysis
14. Decompiler.com – online APK and Java decompiler

Reverse Engineering

1. Jadx / Jadx-GUI – Dex-to-Java decompiler, the current de facto standard for reading Android bytecode as readable Java
2. Apktool – decompiles/rebuilds APK resources and Smali, essential for repackaging and resource-level edits
3. Smali/Baksmali – assembler/disassembler for the dex format
4. Ghidra – NSA's reverse engineering suite; strong for native (.so) library analysis alongside Java-layer tools
5. Dex2Jar – dex to jar converter
6. Enjarify – dex to jar converter from Google, handles cases dex2jar struggles with
7. Bytecode Viewer – all-in-one Java/Android decompiler GUI (integrates CFR, Procyon, Krakatau, FernFlower, JD-GUI)
8. CFR – Java decompiler
9. JD-GUI – Java decompiler with GUI
10. Krakatau – Java decompiler/assembler
11. radare2 – reverse engineering framework, useful for native library analysis
12. Simplify – virtual machine-based Android deobfuscator
13. Obfuscapk – modular Python tool for obfuscating APKs without source code (useful for testing detection resilience)
14. apk-mitm – automatically preps APKs for HTTPS traffic inspection (disables cert pinning, enables user CAs)
15. MVT (Mobile Verification Toolkit) – forensic toolkit to identify signs of compromise (e.g. spyware) on Android/iOS devices
16. Androguard – also a core RE library (see Static Analysis)
17. Dwarf – GUI-based debugger built on Frida for reverse engineering

Fuzz Testing

1. Honggfuzz – general-purpose, feedback-driven fuzzer with Android support
2. Radamsa – general-purpose mutation fuzzer, usable against Android inputs/interfaces

App Repackaging Detectors

1. FSquaDRA2 – detects repackaged Android applications via resource hash comparison

Market Crawlers / APK Downloaders

1. PlaystoreDownloader – downloads APKs directly from Google Play by package name
2. gplaycli – command-line tool to search/download apps from Google Play

Misc Tools

1. mitmproxy – interactive HTTPS proxy, standard for inspecting mobile app traffic
2. AXMLPrinter2 / apktool built-in decoder – converts binary AndroidManifest.xml to readable XML (now bundled in Apktool)
3. Android Vulnerability Test Suite (android-vts) – scans a device for a set of known vulnerabilities
4. Genymotion – Android emulator widely used for security testing on virtual devices with root access
5. nRF Connect / Bluetooth security tools – InternalBlue: Bluetooth experimentation framework based on RE of Broadcom BT controllers

Vulnerable Applications for Practice

1. Damn Insecure Vulnerable Application (DIVA)
2. OWASP MASTG Hacking Playground (mastg-hacking-playground) – official vulnerable apps companion to the OWASP MASTG
3. InsecureShop
4. Android InsecureBankv2
5. Oversecured Vulnerable Android App (OVAA)
6. GoatDroid
7. Sieve (OWASP MASTG UnCrackable Apps) – classic crackme-style targets for practicing RE and dynamic bypass techniques

---

Academic / Research / Publications / Books

Research Papers

1. Exploit Database Papers
2. Android security-related presentations (jacobsoo/AndroidSlides)

Books & Guides

1. SEI CERT Android Secure Coding Standard
2. OWASP Mobile Application Security Testing Guide (MASTG) – the current, actively maintained industry-standard manual for mobile app security testing and reverse engineering (successor to the older MSTG)
3. OWASP Mobile Application Security Verification Standard (MASVS) – baseline security requirements checklist that MASTG test cases map to

Others

1. doridori/Android-Security-Reference
2. b-mueller/android_app_security_checklist
3. tanprathan/MobileApp-Pentest-Cheatsheet
4. HackTricks – Android App Pentesting – actively updated, practical Android pentesting reference (Frida, Objection, bypass techniques, etc.)

---

Exploits / Vulnerabilities / Bugs

Lists & Bulletins

1. Android Security Bulletins – official monthly patch and vulnerability disclosures from Google
2. Android's reported CVEs (CVE Details)
3. OWASP Mobile Top 10 – current version of the standard mobile vulnerability taxonomy
4. Exploit Database – Android search
5. Google Android Security Team's PHA Classifications – official classification of Potentially Harmful Applications (malware)

Malware Datasets & Research

1. Android Malware Github repo (ashishb/android-malware)
2. AndroZoo – large, growing collection of Android apps from multiple sources including Google Play, for research use
3. Contagio Mobile Malware Mini Dump
4. CIC Android Adware and General Malware Dataset
5. Drebin Dataset
6. Koodous – community-driven malware sample repository with YARA rule hunting (also listed above as an analyzer)

Bounty Programs

1. Google Play Security Reward Program (GPSRP) – rewards for vulnerabilities found in popular Android apps
2. Android and Google Devices Security Reward Program

How to Report Security Issues

1. Android – reporting security issues
2. Google Bug Hunters – Android program
3. B3nac/Android-Reports-and-Resources – curated list of disclosed Android HackerOne reports and RE resources

---

Blogs, Write-ups & Research Feeds

Ongoing sources of technical write-ups, exploit analyses, and industry commentary — far more valuable long-term than any static tool list, since this is where new techniques actually surface first.

Vendor & Platform Research Teams

1. Google Project Zero – in-depth, technical write-ups of real 0-day and n-day exploits, including a recurring "In-the-Wild" series specifically on Android exploit chains
2. Android Offensive Security Team Blog – Google's own Android red team publishing deep technical posts on kernel/GPU/Binder exploitation (e.g. Qualcomm KGSL, Binder fuzzing)
3. Google Online Security Blog – official announcements on Android platform security, Play Protect, and ecosystem-wide defenses
4. Google Bug Hunters Blog – write-ups and reward program updates from Google's vulnerability reward programs, including Android and Google Play
5. NCC Group Research Blog – regular mobile app pentest write-ups and tooling releases from a long-running research team
6. WithSecure Labs Blog – successor to MWR Labs/F-Secure Labs, frequent Android/mobile research

Independent & Vendor Security Research

1. Oversecured Blog – frequent, highly technical Android vulnerability-class write-ups (deep-links, exported components, custom permissions, etc.)
2. NowSecure Blog – mobile app security research, threat analysis, and testing guidance
3. Guardsquare Blog – Android app hardening, obfuscation, and reverse-engineering-resistance research (maintainers of ProGuard/DexGuard)
4. MobSF Blog / Docs Updates – release notes and technique write-ups tied to the MobSF framework
5. HackTricks – Android App Pentesting – continuously updated practical playbook, more like a living cheat-sheet than a one-off post
6. Payatu Blog – Android/IoT pentesting write-ups from the team behind DIVA

CTF & Vulnerability Write-ups

1. CVE Details – Google Android – browse individual CVEs, many of which link out to the original researcher's write-up
2. GitHub topic: android-exploitation – community-maintained PoCs and write-ups for specific Android CVEs
3. Exploit-DB – Android – submitted PoC exploits and advisories

---

Communities, Forums & Conferences

1. r/AskNetsec and r/netsec – general security discussion, Android write-ups get shared regularly
2. XDA Developers Security Forum – long-running community around Android rooting, ROMs, and device-level security
3. OWASP MAS Slack / Community – official community channel for the MASVS/MASTG project, good place to ask testing methodology questions
4. DEF CON Mobile/Android talks archive – recordings and slides from years of Android-focused DEF CON talks
5. Black Hat Briefings Archive – searchable archive of Black Hat talks, many with full Android exploitation papers/slides

---