android-security-awesome/README.md
Shayan Rais d6ef30a889 added AOSP - Issue tracker
added AOSP - Issue tracker
strikeout depreciated Vulnerability Google Doc
removed Root Exploits (from Drozer issue )
2017-02-17 23:36:30 +05:00

15 KiB
Raw Blame History

android-security-awesome Awesome

A collection of android security related resources.

  1. TOOLS
  2. ACADEMIC / RESEARCH / PUBLICATIONS / BOOKS
  3. EXPLOITS / VULNERABILITIES / BUGS

#TOOLS

Online Analyzers

  1. AndroTotal

Static Analysis Tools

  1. Androwarn - detect and warn the user about potential malicious behaviours developped by an Android application.

App Vulnerability Scanners

  1. QARK - QARK by LinkedIn is for app developers to scan app for security issues
  • AndroBugs
  • Nogotofail
  • Devknox - Autocorrect security issues as if it was spell check from your IDE
  • JAADAS - Joint intraprocedure and interprocedure program analysis tool to find vulnerabilities in Android apps, built on Soot and Scala

Dynamic Analysis Tools

  1. Android DBI frameowork
  2. Androl4b- A Virtual Machine For Assessing Android applications, Reverse Engineering and Malware Analysis
  • Android Malware Analysis Toolkit - (linux distro) Earlier it use to be an online analyzer
  • Mobile-Security-Framework MobSF - Mobile Security Framework is an intelligent, all-in-one open source mobile application (Android/iOS) automated pen-testing framework capable of performing static, dynamic analysis and web API testing.
  • AppUse custom build for pentesting
  • Cobradroid custom image for malware analysis
  • ViaLab Community Edition
  • Droidbox
  • Mercury
  • Drozer
  • Xposed - equivalent of doing Stub based code injection but without any modifications to the binary
  • Inspeckage - Android Package Inspector - dynamic analysis with api hooks, start unexported activities and more. (Xposed Module)
  • Android Hooker - Dynamic Java code instrumentation (requires the Substrate Framework)
  • ProbeDroid - Dynamic Java code instrumentation
  • Android Tamer - Virtual / Live Platform for Android Security Professionals
  • DECAF - Dynamic Executable Code Analysis Framework based on QEMU (DroidScope is now an extension to DECAF)
  • CuckooDroid - Android extension for Cuckoo sandbox
  • Mem - Memory analysis of Android (root required)
  • Crowdroid unable to find the actual tool
  • AuditdAndroid android port of auditd, not under active development anymore
  • Android Security Evaluation Framework - not under active development anymore
  • Android Reverse Engineering ARE (android reverse engineering) not under active development anymore
  • Aurasium Practical security policy enforcement for Android apps via bytecode rewriting and in-place reference monitor.
  • Android Linux Kernel modules
  • Appie - Appie is a software package that has been pre-configured to function as an Android Pentesting Environment.It is completely portable and can be carried on USB stick or smartphone.This is a one stop answer for all the tools needed in Android Application Security Assessment and an awesome alternative to existing virtual machines.
  • StaDynA - a system supporting security app analysis in the presence of dynamic code update features (dynamic class loading and reflection). This tool combines static and dynamic analysis of Android applications in order to reveal the hidden/updated behavior and extend static analysis results with this information.
  • DroidAnalytics - incomplete
  • Vezir Project - Virtual Machine for Mobile Application Pentesting and Mobile Malware Analysis
  • MARA - Mobile Application Reverse engineering and Analysis Framework
  • NowSecure Lab Automated - Enterprise tool for mobile app security testing both Android and iOS mobile apps. Lab Automated features dynamic and static analysis on real devices in the cloud to return results in minutes.
  • Taintdroid - requires AOSP compilation

Reverse Engineering

  1. Smali/Baksmali apk decompilation

Fuzz Testing

  1. IntentFuzzer

App Repackaging Detectors

  1. FSquaDRA - a tool for detection of repackaged Android applications based on app resources hash comparison.

Sample Sources

  1. Contagio Mini Dump
  2. Android Malware Github repo

Market Crawlers

  1. Google play crawler (Java)

Misc Tools

  1. smalihook

#ACADEMIC / RESEARCH / PUBLICATIONS / BOOKS

Research Papers

  1. Android security related presentations

Books

  1. SEI CERT Android Secure Coding Standard

Tutorials

  1. Android Reverse Engineering 101 by Daniele Altomare

#EXPLOITS / VULNERABILITIES / BUGS

List

  1. Android Security Bulletins

Bounty Programs

  1. Android Security Reward Program

How to report

  1. Android - reporting security issues

Other Awesome Lists

Other amazingly awesome lists can be found in the awesome-awesomeness list.

Contributing

Your contributions are always welcome!