Tools

hunt-benito/two-dots-and-a-slash-cve-2026-18907-tecno-hi-browser-download-path-traversal

Python PoC for CVE-2026-18907 path traversal in TECNO Hi Browser's download handler. Includes malicious HTTP server and naive downloader to…

hunt-benito/one-multiply-too-many-cve-2026-70638-llama-cpp-android-jni-integer-overflow

Reproduces the CVE-2026-70638 integer overflow in llama.cpp Android JNI with a safe arithmetic demo, malicious GGUF generator, and Frida hook for…

zhengxr930/maleval

Official code for the ISSTA 2026 paper: Is "Knowing It’s Malicious" Enough? Evaluating LLMs for Fine-Grained Malware Behavior Auditing

iqsec-lab/freemoca

Memory-free continual learning framework for malware classification using mode connectivity-based interpolation. Supports class-incremental and…

logesh-git001/cve-2025-48593

"A single malicious packet can own your device." — Android Security Team, Nov 2025

charles2gan/gda-android-reversing-tool

the fastest and most powerful android decompiler(native tool working without Java VM) for the APK, DEX, ODEX, OAT, JAR, AAR, and CLASS file. which…

gitamans/zygoteexploitdemo

Educational demonstration of CVE-2024-31317 Zygote Injection Vulnerability on Android

google/permhash

Framework for hashing declared permissions in Chromium extensions and APKs, enabling clustering, hunting, and pivoting across potentially malicious…

sridhar-sec/evildroid

EvilDroid automates the exploitation of CVE-2024-0044, installing malicious payloads on a target device and extracting sensitive data. It features…

cyb3r-w0lf/dirty_stream-android-poc

Android - Dirty Stream exploit for MI-File Explorer V1-210567 version. CVE-2024-35205

abbiy/cve-2024-36842-backdooring-oncord-android-sterio-

CVE-2024-36842, Creating Persistent Backdoor on Oncord+ android/ios car infotaiment using malicious script!

ireshchaminda1/android-privilege-escalation-remote-access-vulnerability-cve-2015-1805

AndroRAT is a capability that can be used to inject a root exploit as a silent installation to perform a malicious task on the device. This AndroRAT…

irsl/cve-2022-3168-adb-unexpected-reverse-forwards

Proof of concept code to exploit flaw in adb that allowed opening network connections on the host to arbitrary destinations

aemmitt-ns/pacpoc

A local PoC exploit for CVE-2019-2205

haxatron/cve-2022-0219

Proof-of-concept exploit for CVE-2022-0219, an XXE vulnerability in Jadx that allows local file disclosure when exporting malicious APK files via the…

aau-network-security/hostage

Low Interaction Mobile Honeypot

maaaaz/androwarn

Yet another static code analyzer for malicious Android applications

eudemonics/scaredycat

Python script to generate a malicious MP4 file and start a CherryPy web server hosting a simple HTML page with the embedded file. Exploits another…