The Flutter Decompiler: CLI tool that decompiles Flutter Android AOT (libapp.so) into Dart-like pseudocode, supporting obfuscated builds.
Automated Firebase recon and security scanner. Extracts from APKs, IPAs or web and checks for unauthorized read and write access on Firestore, Realtime Database, Storage buckets, Remote Config, Cloud Functions, and detects hardcoded service account keys.
Complete Kali NetHunter KeX Rootless Setup for Android with Working Audio & Browser Sound | Mobile Penetration Testing Environment | Termux
Browser-based Android console, APK decompiler and security analyzer. Mirror, logcat, shell, Frida, jadx, and static and dynamic analysis, with no drivers or adb server.
🪝 Android pentesting toolkit - Frida server manager + Burp Suite proxy
Magisk module for installing Burp Suite CA certificates into Android system trust stores for controlled mobile pentesting labs.
Android deeplink, Intent, and WebView bridge assessment helper for ethical hacking
APK-Translate is a Python script that converts localized app strings to English to simplify mobile pentesting, reverse engineering, and API security testing workflows.
A comprehensive collection of Frida scripts and Python tools for Android dynamic analysis. Includes PoCs for bypassing SSL pinning, root detection, obfuscation, and client-side cryptographic integrity checks.
Your complete roadmap to Android Mobile Penetration Testing Interactive mindmap with tools, methodologies, vulnerable practice apps, and official documentation links. Everything in one place for beginners and pros alike.
A curated resource for mobile security testing based on OWASP MASTG. Includes notes, tools, and practical examples for pentesters and developers.
A comprehensive penetration testing toolkit for Flutter applications. Includes SSL pinning bypass techniques, Frida scripts, static/dynamic analysis guides, automated security scanning tools, and real-world case studies. Everything you need to assess Flutter app security on Android & iOS
Not So deepLink is a python script allowing to list and verify deeplinks and Universal Links from Android and iOS apps using an ADB access or an APK/IPA file. It can also list some potential deeplinks handling in code samples using pattern matches (Android Only).
A Bash tool to automatically install BurpSuite certificates into Android system stores (e.g. Genymotion) via ADB
A modern, intentionally vulnerable iOS app for learning mobile penetration testing.
VaultPay is scaffolded—a modern wallet app with all ten 2024 risks planted and cross-mapped to MASVS v2.1.0.
EasyShop is a deliberately vulnerable Android application created for mobile pentesting and security training workshops. It provides hands-on practice for identifying, exploiting, and understanding common Android security vulnerabilities in a safe, controlled learning environment.
Hermes-Sens is an automated static analysis tool for React Native Android applications. It decompiles APKs using apktool, decompiles Hermes bytecode into pseudo-JavaScript, and extracts sensitive artifacts such as secrets, tokens, endpoints, and authentication logic using pattern-based analysis.
Intentionally vulnerable Android e-commerce app for mobile penetration testing training with 40+ documented vulnerabilities across OWASP Mobile Top 10, LLM Top 10 and Business Logic flaws
High-speed multithreaded ICMP network discovery tool for Termux (no root required)
To associate your repository with the mobile-pentesting topic, visit your repo's landing page and select "manage topics."