#1Tools focused on penetration testing, reversing, and securing Android apps and the Android OS.
Kitploit recommended
giveen/decomp.anythingdecomp.wtf fork: Windows PE matching, MinGW/clang-cl toolchains, and an optional REA MCP bridge
gvcoder09/nodpi4androidAndroid proxy app that circumvents Deep Packet Inspection censorship by fragmenting TLS ClientHello packets and rewriting the TLS version to restore…
r3n3r0/cve-2026-0006-step-2Research package demonstrating a leak-assisted ROP chain in Android media.swcodec via the CVE-2026-0006 APV decoder heap overflow, with payload…
maoabc/nmmpdex-vm used to protect the android classes.dex file
openbba0/bbaAndroid app-cloning sandbox with a Frida-style CLI that spawns or attaches to cloned apps and injects QuickJS scripts using Gum Interceptor and…
maximilianfeix/hexveroKnow what changed inside your app: inspect Electron apps and binaries, trace findings to file and line, compare releases. Locally, without executing…
xv4l3x/hermitInspects, decompiles and structurally patches Hermes bytecode (HBC) from React Native apps, with a GDB-style REPL, CFG, decompiler and re-serializing…
reverserid/juriga fully autonomous AI agent for reverse engineering
githubsecuritylab/seclab-taskflowsExample AI-agent taskflows and MCP servers for auditing source code, triaging issues, and detecting vulnerabilities across web, Android, and iOS…
bromite/bromiteAndroid Chromium fork with built-in ad blocking, anti-fingerprinting mitigations, DNS-over-HTTPS, and hardened privacy and security defaults.
grapheneos/vanadiumPrivacy and security hardened Chromium build providing the WebView and default browser for GrapheneOS, with OS-level hardening and compatibility…
uazo/cromiteHardened Chromium/Bromite fork for Android, Windows and Linux with built-in ad blocking, anti-fingerprinting mitigations and privacy-focused patches.
b4sith-sec/gu3ssweakDeliberately vulnerable Android app for mobile security research and bug bounty practice - OWASP Mobile Top 10
wheregoes/byd-dolphin-hackingReverse engineering the BYD Dolphin head unit — CAN bus, AVAS, NFC keys, OTA, and more. DiLink 3 / Android 10.
mg1937/ascFast Android APK decompiler front-end that queries compiled DEX artifacts directly, extracting classes and cross-references in milliseconds without…
techupdate24/capacitor-flaw-cve-2026-103922A complete guide and workflow for integrating Agile sprints with DevOps CI/CD pipelines.
ariyanpegu/ghostlock-appGhostLock One-Tap Execution App (CVE-2026-43499)
wonjj6768/lenovo-tb365fc-ghostlock-cve-2026-43499GhostLock (CVE-2026-43499) root + KernelSU LKM for the Lenovo TB365FC (ZUXOS / Android 16, kernel 5.15.170)
