└── README.md /README.md: -------------------------------------------------------------------------------- 1 | Collection of Android security related resources 2 | ======================== 3 |
4 |
5 | 6 | 7 | A collection of android security related resources. 8 | 9 | A lot of work is happening in academia and industry on tools to perform dynamic analysis, static analysis and reverse engineering of android apps. 10 | 11 | ##Books 12 | 01. http://amzn.to/2jkFvjg Android Security Internals: An In-Depth Guide to Android's Security Architecture 13 | 02. http://amzn.to/2jkK0uf Android Security: Attacks and Defenses 14 | 03. http://amzn.to/2jLHqd6 Android Security Cookbook 15 | 04. http://amzn.to/2jLL5HR Android Hacker's Handbook 16 | 05. http://amzn.to/2jLPY3L Android Forensics: Investigation, Analysis and Mobile Security for Google Android 17 | 06. http://amzn.to/2ipWhhu Android Apps Security 18 | 07. http://amzn.to/2iq3nCk Android Malware and Analysis 19 | 08. http://amzn.to/2jkBlrR Mobile Forensic Investigations: A Guide to Evidence Collection, Analysis, and Presentation 20 | 09. http://amzn.to/2jkJIU7 The Mobile Application Hacker's Handbook 21 | 10. http://amzn.to/2iyIXW8 Android Application Security Essentials 22 | 11. http://amzn.to/2jLJvWs Learning Pentesting for Android Devices 23 | 24 | 25 | ## ONLINE ANALYZERS 26 | 27 | 1. [AndroTotal](http://andrototal.org/) 28 | * [Dexter](https://dexter.dexlabs.org/) 29 | * [Tracedroid](http://tracedroid.few.vu.nl/) 30 | * [Visual Threat](http://www.visualthreat.com/) 31 | * [Mobile Malware Sandbox](http://www.mobilemalware.com.br/analysis/index_en.php) 32 | * [MobiSec Eacus](http://www.mobiseclab.org/eacus.jsp) 33 | * [Appknox](https://appknox.com) - not free 34 | * [IBM Security AppScan Mobile Analyzer](https://appscan.bluemix.net/mobileAnalyzer) - not free 35 | * [NVISO ApkScan](https://apkscan.nviso.be/) 36 | * [AVC UnDroid](http://www.av-comparatives.org/avc-analyzer/) 37 | * [Fireeye](https://fireeye.ijinshan.com/)- max 60MB 15/day 38 | * [habo](https://habo.qq.com/) 10/day 39 | * [Virustotal](https://www.virustotal.com/)-max 128MB 40 | * [Fraunhofer App-ray](https://www.app-ray.com) - not free 41 | * [AppCritique](http://appcritique.io/) - Upload your Android APKs and receive comprehensive free security assessments. 42 | 43 | 44 | ## STATIC ANALYSIS TOOLS 45 | 46 | 1. [Androwarn](https://github.com/maaaaz/androwarn/) - detect and warn the user about potential malicious behaviours developped by an Android application. 47 | * [ApkAnalyser](https://github.com/sonyxperiadev/ApkAnalyser) 48 | * [APKInspector](https://github.com/honeynet/apkinspector/) 49 | * [Droid Intent Data Flow Analysis for Information Leakage](https://www.cert.org/secure-coding/tools/didfail.cfm) 50 | * [DroidLegacy](https://bitbucket.org/srl/droidlegacy) 51 | * [Several tools from PSU](http://siis.cse.psu.edu/tools.html) 52 | * [Smali CFG generator](https://github.com/EugenioDelfa/Smali-CFGs) 53 | * [FlowDroid](https://blogs.uni-paderborn.de/sse/tools/flowdroid/) 54 | * [Android Decompiler](https://www.pnfsoftware.com/) – not free 55 | * [PSCout](http://pscout.csl.toronto.edu/) - A tool that extracts the permission specification from the Android OS source code using static analysis 56 | * [Amandroid](http://amandroid.sireum.org/) 57 | * [SmaliSCA](https://github.com/dorneanu/smalisca) - Smali Static Code Analysis 58 | * [CFGScanDroid](https://github.com/douggard/CFGScanDroid) - Scans and compares CFG against CFG of malicious applications 59 | * [Madrolyzer](https://github.com/maldroid/maldrolyzer) - extracts actionable data like C&C, phone number etc. 60 | * [SPARTA](http://www.cs.washington.edu/sparta) - verifies (proves) that an app satisfies an information-flow security policy; built on the [Checker Framework](http://types.cs.washington.edu/checker-framework/) 61 | * [ConDroid](https://github.com/JulianSchuette/ConDroid) - Performs a combination of symoblic + concrete execution of the app 62 | 63 | ## APP VULNERABILITY SCANNERS 64 | 65 | 1. [QARK](https://github.com/linkedin/qark/) - QARK by LinkedIn is for app developers to scan app for security issues 66 | * [AndroBugs](https://github.com/AndroBugs/AndroBugs_Framework) 67 | * [Nogotofail](https://github.com/google/nogotofail) 68 | * [Devknox](https://devknox.io/) - Autocorrect security issues as if it was spell check from your IDE 69 | 70 | ## DYNAMIC ANALYSIS TOOLS 71 | 72 | 1. [Android DBI frameowork](http://www.mulliner.org/blog/blosxom.cgi/security/androiddbiv02.html) 73 | 2. [Androl4b](https://github.com/sh4hin/Androl4b)- A Virtual Machine For Assessing Android applications, Reverse Engineering and Malware Analysis 74 | * [Android Malware Analysis Toolkit](http://www.mobilemalware.com.br/amat/download.html) - (linux distro) Earlier it use to be an [online analyzer](http://dunkelheit.com.br/amat/analysis/index_en.php) 75 | * [Mobile-Security-Framework MobSF](https://github.com/ajinabraham/Mobile-Security-Framework-MobSF) - Mobile Security Framework is an intelligent, all-in-one open source mobile application (Android/iOS) automated pen-testing framework capable of performing static, dynamic analysis and web API testing. 76 | * [AppUse](https://appsec-labs.com/AppUse/) – custom build for pentesting 77 | * [Cobradroid](https://thecobraden.com/projects/cobradroid/) – custom image for malware analysis 78 | * [ViaLab Community Edition](https://www.nowsecure.com/blog/2014/09/09/introducing-vialab-community-edition/) 79 | * [Droidbox](https://github.com/pjlantz/droidbox) 80 | * [Mercury](https://labs.mwrinfosecurity.com/tools/2012/03/16/mercury/) 81 | * [Drozer](https://labs.mwrinfosecurity.com/tools/drozer/) 82 | * [Xposed](https://forum.xda-developers.com/showthread.php?t=1574401) - equivalent of doing Stub based code injection but without any modifications to the binary 83 | * [Inspeckage](https://github.com/ac-pm/Inspeckage) - Android Package Inspector - dynamic analysis with api hooks, start unexported activities and more. (Xposed Module) 84 | * [Android Hooker](https://github.com/AndroidHooker/hooker) - Dynamic Java code instrumentation (requires the Substrate Framework) 85 | * [ProbeDroid](https://github.com/ZSShen/ProbeDroid) - Dynamic Java code instrumentation 86 | * [Android Tamer](https://androidtamer.com/) - Virtual / Live Platform for Android Security Professionals 87 | * [DECAF](https://github.com/sycurelab/DECAF) - Dynamic Executable Code Analysis Framework based on QEMU (DroidScope is now an extension to DECAF) 88 | * [CuckooDroid](https://github.com/idanr1986/cuckoo-droid) - Android extension for Cuckoo sandbox 89 | * [Mem](https://github.com/MobileForensicsResearch/mem) - Memory analysis of Android (root required) 90 | * [Crowdroid](http://www.ida.liu.se/labs/rtslab/publications/2011/spsm11-burguera.pdf) – unable to find the actual tool 91 | * [AuditdAndroid](https://github.com/nwhusted/AuditdAndroid) – android port of auditd, not under active development anymore 92 | * [Android Security Evaluation Framework](https://code.google.com/p/asef/) - not under active development anymore 93 | * [Android Reverse Engineering](https://redmine.honeynet.org/projects/are/wiki) – ARE (android reverse engineering) not under active development anymore 94 | * [Aurasium](https://github.com/xurubin/aurasium) – Practical security policy enforcement for Android apps via bytecode rewriting and in-place reference monitor. 95 | * [Android Linux Kernel modules](https://github.com/strazzere/android-lkms) 96 | * [Appie](https://manifestsecurity.com/appie/) - Appie is a software package that has been pre-configured to function as an Android Pentesting Environment.It is completely portable and can be carried on USB stick or smartphone.This is a one stop answer for all the tools needed in Android Application Security Assessment and an awesome alternative to existing virtual machines. 97 | * [StaDynA](https://github.com/zyrikby/StaDynA) - a system supporting security app analysis in the presence of dynamic code update features (dynamic class loading and reflection). This tool combines static and dynamic analysis of Android applications in order to reveal the hidden/updated behavior and extend static analysis results with this information. 98 | * [DroidAnalytics](https://github.com/zhengmin1989/DroidAnalytics) - incomplete 99 | * [Vezir Project](https://github.com/oguzhantopgul/Vezir-Project) - Virtual Machine for Mobile Application Pentesting and Mobile Malware Analysis 100 | * [MARA](https://github.com/xtiankisutsa/MARA_Framework) - Mobile Application Reverse engineering and Analysis Framework 101 | * [NowSecure Lab Automated](https://www.nowsecure.com/blog/2016/09/19/announcing-nowsecure-lab-automated/) - Enterprise tool for mobile app security testing both Android and iOS mobile apps. Lab Automated features dynamic and static analysis on real devices in the cloud to return results in minutes. 102 | * ~~[Taintdroid](https://appanalysis.org/download.html)~~ - requires AOSP compilation 103 | 104 | ## REVERSE ENGINEERING 105 | 106 | 1. [Smali/Baksmali](https://github.com/JesusFreke/smali) – apk decompilation 107 | * [emacs syntax coloring for smali files](https://github.com/strazzere/Emacs-Smali) 108 | * [vim syntax coloring for smali files](http://codetastrophe.com/smali.vim) 109 | * [AndBug](https://github.com/swdunlop/AndBug) 110 | * [Androguard](https://github.com/androguard/androguard) – powerful, integrates well with other tools 111 | * [Apktool](https://ibotpeaches.github.io/Apktool/) – really useful for compilation/decompilation (uses smali) 112 | * [Android Framework for Exploitation](https://github.com/appknox/AFE) 113 | * [Bypass signature and permission checks for IPCs](https://github.com/iSECPartners/Android-KillPermAndSigChecks) 114 | * [Android OpenDebug](https://github.com/iSECPartners/Android-OpenDebug) – make any application on device debuggable (using cydia substrate). 115 | * [Dare](http://siis.cse.psu.edu/dare/index.html) – .dex to .class converter 116 | * [Dex2Jar](https://github.com/pxb1988/dex2jar) - dex to jar converter 117 | * [Enjarify](https://github.com/google/enjarify) - dex to jar converter from Google 118 | * [Dedexer](http://dedexer.sourceforge.net) 119 | * [Fino](https://github.com/sysdream/fino) 120 | * [Frida](http://www.frida.re/) - inject javascript to explore applications and a [GUI tool](https://github.com/antojoseph/diff-gui) for it 121 | * [Indroid](https://bitbucket.org/aseemjakhar/indroid) – thread injection kit 122 | * [IntentSniffer](https://www.nccgroup.trust/us/about-us/resources/intent-sniffer/) 123 | * [Introspy](https://github.com/iSECPartners/Introspy-Android) 124 | * [Jad]( http://varaneckas.com/jad/) - Java decompiler 125 | * [JD-GUI](https://github.com/java-decompiler/jd-gui) - Java decompiler 126 | * [CFR](http://www.benf.org/other/cfr/) - Java decompiler 127 | * [Krakatau](https://github.com/Storyyeller/Krakatau) - Java decompiler 128 | * [Procyon](https://bitbucket.org/mstrobel/procyon/wiki/Java%20Decompiler) - Java decompiler 129 | * [FernFlower](https://github.com/fesh0r/fernflower) - Java decompiler 130 | * [Redexer](https://github.com/plum-umd/redexer) – apk manipulation 131 | * [Smali viewer](http://blog.avlyun.com/wp-content/uploads/2014/04/SmaliViewer.zip) 132 | * ~~[ZjDroid](https://github.com/BaiduSecurityLabs/ZjDroid)~~, ~~[fork/mirror](https://github.com/yangbean9/ZjDroid)~~ 133 | * [Simplify Android deobfuscator](https://github.com/CalebFenton/simplify) 134 | * [Bytecode viewer](https://github.com/Konloch/bytecode-viewer) 135 | * [Radare2](https://github.com/radare/radare2) 136 | 137 | ## FUZZ TESTING 138 | 139 | 1. [IntentFuzzer](https://www.nccgroup.trust/us/about-us/resources/intent-fuzzer/) 140 | * [Radamsa Fuzzer](https://github.com/anestisb/radamsa-android) 141 | * [Honggfuzz](https://github.com/google/honggfuzz) 142 | * [An Android port of the melkor ELF fuzzer](https://github.com/anestisb/melkor-android) 143 | * [Media Fuzzing Framework for Android](https://github.com/fuzzing/MFFA) 144 | * [AndroFuzz](https://github.com/jonmetz/AndroFuzz) 145 | 146 | ## APP REPACKAGING DETECTORS 147 | 148 | 1. [FSquaDRA](https://github.com/zyrikby/FSquaDRA) - a tool for detection of repackaged Android applications based on app resources hash comparison. 149 | 150 | ## EXPLOITABLE VULNERABILITIES 151 | 152 | 1. [Vulnerability Google Doc](https://docs.google.com/spreadsheet/pub?key=0Am5hHW4ATym7dGhFU1A4X2lqbUJtRm1QSWNRc3E0UlE&single=true&gid=0&output=html) 153 | * [Root Exploits (from Drozer issue #56)](https://github.com/mwrlabs/drozer/issues/56) 154 | 155 | ## SAMPLE SOURCES 156 | 157 | 1. [Contagio Mini Dump](http://contagiominidump.blogspot.com) 158 | 2. [Android Malware Github repo](https://github.com/ashishb/android-malware) 159 | * [Open Source database](https://code.google.com/p/androguard/wiki/DatabaseAndroidMalwares) 160 | * [Drebin](http://user.informatik.uni-goettingen.de/~darp/drebin/) 161 | * [Admire](http://admire.necst.it/) 162 | * [MalGenome](http://www.malgenomeproject.org/policy.html) - contains 1260 malware samples categorized into 49 different malware families, free for research purpose. 163 | * [VirusTotal Malware Intelligence Service](https://www.virustotal.com/en/about/contact/) - powered by VirusTotal,not free 164 | 165 | ## READING MATERIAL 166 | 167 | 1. [Android Security (and Not) Internals](http://www.zhauniarovich.com/pubs.html) 168 | * [Android security related presentations](https://github.com/jacobsoo/AndroidSlides) 169 | * [A good collection of static analysis papers](https://tthtlc.wordpress.com/2011/09/01/static-analysis-of-android-applications/) 170 | 171 | ## MARKET CRAWLERS 172 | 173 | 1. [Google play crawler (Java)](https://github.com/Akdeniz/google-play-crawler) 174 | * [Google play crawler (Python)](https://github.com/egirault/googleplay-api) 175 | * [Google play crawler (Node) ](https://github.com/dweinstein/node-google-play) - get app details and download apps from official Google Play Store. 176 | * [Aptoide downloader (Node)](https://github.com/dweinstein/node-aptoide) - download apps from Aptoide third-party Android market 177 | * [Appland downloader (Node)](https://github.com/dweinstein/node-appland) - download apps from Appland third-party Android market 178 | 179 | ## MISC TOOLS 180 | 181 | 1. [smalihook](http://androidcracking.blogspot.com/2011/03/original-smalihook-java-source.html) 182 | * [APK-Downloader](http://codekiem.com/2012/02/24/apk-downloader/) 183 | * [AXMLPrinter2](http://code.google.com/p/android4me/downloads/detail?name=AXMLPrinter2.jar) - to convert binary XML files to human-readable XML files 184 | * [adb autocomplete](https://github.com/mbrubeck/android-completion) 185 | * [Dalvik opcodes](http://pallergabor.uw.hu/androidblog/dalvik_opcodes.html) 186 | * [Opcodes table for quick reference](http://www.xchg.info/corkami/opcodes_tables.pdf) 187 | * [ExploitMe Android Labs](http://securitycompass.github.io/AndroidLabs/setup.html) - for practice 188 | * [GoatDroid](https://github.com/jackMannino/OWASP-GoatDroid-Project) - for practice 189 | * [mitmproxy](https://github.com/mitmproxy/mitmproxy) 190 | * [dockerfile/androguard](https://github.com/dweinstein/dockerfile-androguard) 191 | * [Android Vulnerability Test Suite](https://github.com/AndroidVTS/android-vts) - android-vts scans a device for set of vulnerabilities 192 | 193 | ## TUTORIALS 194 | 1. [Android Reverse Engineering 101 by Daniele Altomare](http://www.fasteque.com/android-reverse-engineering-101-part-1/) 195 | 196 | 197 | Please have a look at 198 | * [Best Hacking Books](http://www.kalitut.com/2016/12/best-ethical-hacking-books.html) 199 | * [Best Reverse Engineering Books](http://www.kalitut.com/2017/01/Best-reverse-engineering-books.html) 200 | * [Best Machine learning Books](http://www.kalitut.com/2017/01/machine-learning-book.html) 201 | * [Best 5 books Programming Books](http://www.kalitut.com/2017/01/Top-Programming-Books.html) 202 | * [Best Java Books](http://www.kalitut.com/2017/01/Best-Java-Programming-Books.html) 203 | --------------------------------------------------------------------------------