stuxctf/slythestxMobile app security auditing tool focused on automating SAST analysis, identifying underlying technologies (React Native, Flutter, Xamarin, native), and enabling deeper testing on rooted or jailbroken devices.
The Swiss Army Worm for Mobile Security
A unified framework for static code analysis and dynamic vulnerability hunting on iOS and Android.
Slythestx is a mobile-focused security toolkit that brings static analysis (SAST) and dynamic analysis (DAST) together under a single interface. It is built for security researchers and mobile pentesters who need to quickly fingerprint a target's technology stack, audit its source for known-bad patterns, and interact with a live device — all without juggling a dozen separate tools.
The engine ships as a containerized web application, exposing a browser-based dashboard (http://localhost:3000) backed by a Node.js/TypeScript analysis core.
| Category | Capability |
|---|---|
| Technology Detection | Automatic identification of the underlying framework — React Native, Flutter, Xamarin, .NET MAUI, Cordova, or native iOS/Android |
| Static Analysis (SAST) | Rule-based scanning engine driven by customizable JSON rule-sets for deep code auditing |
| Security Posture Detection | Heuristic regex engine that flags active protections such as root/jailbreak detection, SSL pinning, and debug/anti-tamper checks |
| Secret Scanning | Detection of hardcoded credentials, API keys, and other sensitive strings embedded in app code |
| Permission & Manifest Auditing | Parsing of Android manifests and app permissions for over-privileged or risky declarations |
| Android Toolkit (ADB) | Full ADB integration for package extraction and direct exploration of /data/data/ app storage |
| iOS Toolkit | USB/SSH connectivity to jailbroken devices via libimobiledevice, with automatic device detection |
| App Enumeration | Cross-platform listing of installed apps (bundle ID, package name, version) |
| Container & Sandbox Mapping | Automatic resolution of app sandbox paths — Documents, Library, Preferences, Caches |
| IPA Extraction | On-device IPA extraction with automatic Payload structure rebuilding and fast SFTP download |
| Live Log Monitoring | Real-time Logcat streaming with custom filters for surgical debugging |
| Smart Tool Suggestions | Context-aware recommendations of external security tools based on the detected stack |
Slythestx is organized around two core pillars: analyzers (static, tech-stack aware inspection modules) and device drivers (dynamic interaction with connected iOS/Android hardware).
Each analyzer plugs into the core engine and runs when its corresponding technology is detected, keeping scans fast and noise-free.
| Analyzer | Target Stack | Purpose |
|---|---|---|
technologyDetector | All | Fingerprints the app's underlying framework |
appInfoAnalyzer | All | Extracts general app metadata |
manifestAnalyzer | Android | Parses AndroidManifest.xml |
permissionAnalyzer | Android / iOS | Audits declared permissions |
securityMeasuresAnalyzer | All | Detects root/jailbreak checks, SSL pinning, anti-debug logic |
secretScanner | All | Scans source and binaries for hardcoded secrets |
nativeAnalyzer | Native iOS/Android | Analyzes native code paths |
reactAnalyzer | React Native | React Native-specific static analysis |
flutterAnalyzer | Flutter | Flutter-specific static analysis |
xamarinAnalyzer | Xamarin | Xamarin-specific static analysis |
dotnetMauiAnalyzer | .NET MAUI | .NET MAUI-specific static analysis |
cordovaAnalyzer | Cordova/PhoneGap | Cordova-specific static analysis |
libimobiledevice# Clone the repository
git clone https://github.com/stuxctf/slythestx/
cd slythestx
# --- Windows ---
docker-compose.exe -f docker-compose.yml -f docker-compose.windows.yml build
# --- Linux ---
docker-compose -f docker-compose.yml -f docker-compose.linux.yml build
# Launch the engine
docker-compose up -d
Once the containers are running, open your browser at:
http://localhost:3000