#1Tools for assessing, testing, and exploiting mobile applications and devices (Android, iOS).
Kitploit recommended
tegal1337/pocketpentesterOffline-first Android offensive security toolkit with 21 modules for recon, port scanning, subdomain enumeration, SQLi/XSS/JWT exploitation, payload…
xv4l3x/hermitInspects, decompiles and structurally patches Hermes bytecode (HBC) from React Native apps, with a GDB-style REPL, CFG, decompiler and re-serializing…
reverserid/juriga fully autonomous AI agent for reverse engineering
vmoranv/jshookmcpA search-first, profile-aware reverse-engineering workspace for AI agents — 735 tools across 36 domains in one MCP server.
darkcodelabs/darkrouteAnti-ALPR-surveillance PWA. The camera archive lives on the device.
githubsecuritylab/seclab-taskflowsExample AI-agent taskflows and MCP servers for auditing source code, triaging issues, and detecting vulnerabilities across web, Android, and iOS…
bromite/bromiteAndroid Chromium fork with built-in ad blocking, anti-fingerprinting mitigations, DNS-over-HTTPS, and hardened privacy and security defaults.
grapheneos/vanadiumPrivacy and security hardened Chromium build providing the WebView and default browser for GrapheneOS, with OS-level hardening and compatibility…
uazo/cromiteHardened Chromium/Bromite fork for Android, Windows and Linux with built-in ad blocking, anti-fingerprinting mitigations and privacy-focused patches.
blacktop/ipsw-diffsPublishes per-build diffs of iOS, iPadOS, and macOS IPSW firmware releases, enabling binary-level comparison of system components across versions and…
vvirei333/abrake27iOS 27 kernelcache RE: SEP dispatch map, AMFI diff, Ghidra workflow
0xblackash/cve-2026-86950Defensive research documentation for CVE-2026-86950, an Apple CoreGraphics out-of-bounds write, covering vulnerability triage, affected versions,…
b4sith-sec/gu3ssweakDeliberately vulnerable Android app for mobile security research and bug bounty practice - OWASP Mobile Top 10
wheregoes/byd-dolphin-hackingReverse engineering the BYD Dolphin head unit — CAN bus, AVAS, NFC keys, OTA, and more. DiLink 3 / Android 10.
mg1937/ascFast Android APK decompiler front-end that queries compiled DEX artifacts directly, extracting classes and cross-references in milliseconds without…
techupdate24/capacitor-flaw-cve-2026-103922A complete guide and workflow for integrating Agile sprints with DevOps CI/CD pipelines.
ariyanpegu/ghostlock-appGhostLock One-Tap Execution App (CVE-2026-43499)
wonjj6768/lenovo-tb365fc-ghostlock-cve-2026-43499GhostLock (CVE-2026-43499) root + KernelSU LKM for the Lenovo TB365FC (ZUXOS / Android 16, kernel 5.15.170)
