awesome-mobile-security - An effort to build a single place for all useful a

项目说明

awesome-mobile-security !awesome

Maintained by @ with contributions from the security and de communities.

Android

General - Blogs, Papers, How To's

* Android: Gaining access to arbitrary* Content Pro
* E: Uni, theft of all cookies from all sites, and more
* Interception of Android implicit intents
* TikTok: three persistent arbitrary 代码 executions and one theft of arbitrary files
* Persistent arbitrary 代码 execution in Android's Google Play Core Library: details, explanation and the PoC - C
* Android: Access to app protected components
* Android: arbitrary 代码 execution package contexts
* Android Pentesting Labs - Step by Step guide for beginners
* An Android Hacking Primer
* Secure an Android Device
* Security tips
* OWASP Mobile Security Testing Guide
* Security Testing for Android Cross Platform Application
* Dive deep into Android Application Security
* Pentesting Android Apps Using Frida
* Mobile Security Testing Guide
* Mobile Application Penetration Testing Cheat Sheet
* Android Applications Re 101
* Android Security Guidelines
* Android WebView
* OWASP Mobile Top 10
* Practical Android Phone Forensics
* Mobile Reverse Engineering Unleashed
* Android Root Detection Bypass Using Objection and Frida Scripts
* quark-引擎 - An Obfuscation-Neglect Android Malware Scoring System
* Root Detection Bypass By Manual 代码 Manipulation.
* Application and 网络 Usage in Android
* GEOST BOTNET - the discovery story of a new Android banking trojan
* Mobile Pentesting With Frida
* Magisk Systemless Root - Detection and Remediation
* AndrODet: An adapti obfuscation detector
* Hands On Mobile API Security
* Zero to Hero - Mobile Application Testing - Android Platform
* How to use FRIDA to bruteforce Secure Startup with FDE-encryption on a Samsung G935F running Android 8
* Android Malware Ad
* AAPG - Android application penetration testing guide
* Bypassing Android Anti-Emulation
* Bypassing Xamarin Certificate Pinning
* Configuring Burp Suite With Android Nougat

Books

* SEI CERT Android Secure Coding Standard
* Android Security Internals
* Android Cookbook
* Android Hacker's Handbook
* Android Security Cookbook
* The Mobile Application Hacker's Handbook
* Android Malware and Analysis
* Android Security: Attacks and Defenses

Courses

* Learning-Android-Security
* Mobile Application Security and Penetration Testing
* Ad Android De
* Learn the art of mobile app de
* Learning Android Malware Analysis
* Android App Reverse Engineering 101
* Android Pentesting for Beginners

Tools

#### Static Analysis

* Amandroid – A Static Analysis Framework
* Androwarn – Yet Another Static Code Analyzer
* APK Analyzer – Static and Analysis Tool
* APK Inspector – A Powerful GUI Tool
* Droid Hunter – Android application analysis and Android pentest 工具
* Error Prone – Static Analysis Tool
* Findbugs – Find Bugs in Ja
* Find Security Bugs – A SpotBugs plugin for security audits of Java web applications.
* Flow Droid – Static Data Flow Tracker
* Smali/Baksmali – Assembler/Disassembler for the dex format
* Smali-CFGs – Smali Control Flow Graph’s
* SPARTA – Static Program Analysis for Reliable Trusted Apps
* Thresher – To check heap reachability properties
* Attack Scanner – To search points to attack
* Gradle Static Analysis Plugin
* Checkstyle – A tool for checking Ja code
* PMD – An extensible multilanguage static 代码 analyzer
* Soot – A Ja Framework
* Android Quality Starter
* QARK – Quick Android Review Kit
* Infer – A Static Analysis 工具 for Java, C, C++ and Objective-C
* Android Check – Static 代码 analysis plugin for Android Project
* FindBugs-IDEA Static byte 代码 analysis to look for bugs in Java 代码
* APK Leaks – Scanning APK file for URIs, endpoints & secrets

#### Dynamic Analysis

* Adhrit - Android Security Suite for in-depth reconnaissance and static bytecode analysis based on Ghera benchmarks
* Android Hooker - Opensource project for dynamic analyses of Android applications
* AppAudit - Online 工具 ( including an API) uses dynamic and static analysis
* AppAudit - A bare-metal analysis 工具 on Android devices
* CuckooDroid - Extension of Cuckoo Sandbox the Open 源码 software
* DroidBox - Dynamic analysis of Android applications
* Droid-FF - Android File Fuzzing 框架
* Drozer
* Marvin - Analyzes Android applications and allows tracking of an app
* Inspeckage
* PATDroid - Collection of tools and data structures for analyzing Android applications
* AndroL4b - Android security machine based on ubuntu-mate
* Radare2 - Unix-like reverse engineering 框架 and commandline tools
* Cutter - Free and Open 源码 RE Platform powered by radare2
* ByteCode - Android APK Reverse Engineering Suite (Decompiler, Editor, Debugger)
* Mobile-Security-Framework MobSF
* CobraDroid - Custom build of the Android operating system geared specifically for application security
* Magisk v20.2 - Root & Uni Systemless Interface
* Runtime Mobile Security (RMS) - is a powerful web interface that helps you to manipulate Android and iOS Apps at Runtime
* MOBEXLER - A Mobile Application Penetration Testing Platform

#### Android Online APK Analyzers

* O - A static scanner for Android apps (APK files) containing 90+ categories
* Android Obser APK Scan
* Android APK Decompiler
* AndroTotal
* NVISO ApkScan
*
* Scan Your APK
* A
* OPSWAT
* ImmuniWeb Mobile App Scanner
* Ostor Lab
* Quixxi
* TraceDroid
* Threat
* App Critique

Labs

* OVAA (O Android App)
* DIVA (Damn insecure and App)
* SecurityShepherd
* Damn Hybrid Mobile App (DVHMA)
* OWASP-mstg
* le
* Android InsecureBankv2
* Purposefully Insecure and Android Application (PIIVA)
* Sieve app
* Dodo
* Digitalbank
* OWASP GoatDroid
* AppKnox Application
* Android Application
* MoshZuk
* Hackme Bank
* Android Security Labs
* Android-InsecureBankv2
* Android-security
*
* FridaLab
* Santoku Linux - Mobile Security VM
*

Talks

* Blowing the Cover of Android Binary Fuzzing (Slides)
* One Step Ahead of Cheaters -- Instrumenting Android Emulators
* Out of the Box: An E of Android Carrier Devices
* Rock appround the clock: Tracking malware de by Android
* Chaosdata - Ghost in the Droid: Possessing Android Applications with ParaSpectre
* Remotely Compromising Android and iOS via a Bug in Broadcom's Wi-Fi Chipsets
* Honey, I Shrunk the Attack Surface – Ad in Android Security Hardening
* Hide Android Applications in Images
* Scary Code in the Heart of Android
* Fuzzing Android: A Recipe For Unco Inside System Components In Android
* Unpacking the Packed Unpacker: Reverse Engineering an Android Anti-Analysis Nati
* Android FakeID Walkthrough
* Unleashing D* on Android Kernel Drivers
* The Smarts Behind Hacking Dumb Devices
* O of common Android app
* Android De 2019
* Android security architecture
* Get the Ultimate Pri of Android Phone

Misc.

* Android-Reports-and-Resources
* android-security-awesome
* Android Penetration Testing Courses
* Lesser-known Tools for Android Application PenTesting
* android-de - a set of scripts to check Android device security configuration
* apk-mitm - a CLI application that prepares Android APK files for HTTPS inspection
* Andriller - is software utility with a collection of forensic tools for smartphones
* Dexofuzzy: Android malware similarity clustering method using opcode sequence-Paper
* Chasing the Joker
* Side Channel Attacks in 4G and 5G Cellular Networks-Slides
* Shodan.io-mobile-app for Android
* Popular Android Malware 2018
* Popular Android Malware 2019
* Popular Android Malware 2020

iOS

General - Blogs, Papers, How to's

* iOS Security
* Basic iOS Apps Security Testing lab
* IOS Application security – Setting up a mobile pentesting platform
* Collection of the most common found in iOS applications
* IOS_Application_Security_Testing_Cheat_Sheet
* OWASP iOS Basic Security Testing
* Dynamic analysis of iOS apps w/o Jailbreak
* iOS Application Injection
* Low-Hanging Apples: Hunting Credentials and Secrets in iOS Apps
* Checkra1n Era - series
* BFU Extraction: Forensic Analysis of Locked and Disabled iPhones
* HowTo-decrypt-Signal.sqlite-for-IOS
* Can I Jailbreak?
* How to Extract Screen Time Passcodes and Voice Memos from iCloud
* Reverse Engineering Swift Apps
* Mettle your iOS with FRIDA
* A run-time approach for pentesting iOS applications
* iOS Internals vol 2
* Understanding usbmux and the iOS lockdown service
* A Deep Dive into iOS Code Signing
* AirDoS: remotely render any nearby iPhone or iPad unusable
* How to access and traverse a #checkra1n jailbroken iPhone File system using SSH
* Deep dive into iOS Exploit chains found in the wild - Project Zero
* The Fully Remote Attack Surface of the iPhone - Project Zero

Books

* Hacking and Securing iOS Applications: Stealing Data, Hijacking Software, and How to Prevent It
* iOS Penetration Testing
* iOS App Security, Penetration Testing, and De
* IOS Hacker's Handbook
* Hacking iOS Applications a detailed testing guide
* Develop iOS Apps (Swift)
* iOS Programming Cookbook

Courses

* Pentesting iOS Applications
* Reverse Engineering iOS Applications
* App Design and De for iOS

Tools

* Cydia Impactor
* checkra1n jailbreak
* idb - iOS App Security Assessment Tool
* Frida
* Objection - mobile exploration toolkit by Frida
* Bfinject
* iFunbox
* Libimobiledevice - library to communicate with the services of the Apple ios devices
* iRET (iOS Reverse Engineering Toolkit) - includes oTool, dumpDecrypted, SQLite, Theos, Keychain_dumper, Plutil
* Myriam iOS
* iWep Pro - wireless suite of useful applications used to turn your iOS device into a wireless 网络 diagnostic 工具
* Burp Suite
* Cycript
* needle - The iOS Security Testing 框架
* iLEAPP - iOS Logs, Events, And Preferences Parser
* Cutter - Free and Open 源码 RE Platform powered by radare2
* decrypt0r - automatically download and decrypt SecureRom stuff
* iOS Security Suite - an ad and easy-to-use platform security & anti-tampering library

Labs

* OWASP iGoat
* Damn iOS App (DVIA) v2
* Damn iOS App (DVIA) v1
* iPhoneLabs
* iOS-Attack-Defense

Talks

* Behind the Scenes of iOS Security
* Modern iOS Application Security
* Demystifying the Secure Encla
* HackPac Hacking Pointer Authentication in iOS User Space
* Analyzing and Attacking Apple Kernel Drivers
* Remotely Compromising iOS and Escaping the Sandbox
* Reverse Engineering iOS Mobile Apps
* iOS 10 Kernel Heap Re
* KTRW: The journey to build a debuggable iPhone
* The One Weird Trick SecureROM Hates
* Tales of old: untethering iOS 11-Spoiler: Apple is bad at patching
* Messenger Hacking: Remotely Compromising an iPhone through iMessage
* Recreating An iOS 0-Day Jailbreak Out Of Apple's Security Updates
* Reverse Engineering the iOS Simulator’s SpringBoard
* Attacking iPhone XS Max

Misc.

* Most usable tools for iOS penetration testing
* iOS-Security-Guides
* osx-security-awesome - OSX and iOS related security tools
* Trust in Apple's Secret Garden: Exploring & Re Apple's Continuity 协议-Slides
* Apple Platform Security
* Mobile security, forensics & malware analysis with Santoku Linux

项目信息

开发语言：未知

Star 数：3553

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕An effort to build a single place for all useful android and iOS security related stuff. All references and tools belong to their respective owners. I'm just maintaining it.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。