mobsf/mobile-security-framework-mobsfAutomated mobile application security testing framework for Android, iOS, and Windows. Performs static and dynamic analysis, malware detection, and…
ch0pin/rdxA native APK and DEX decompiler written in Rust
chichou/grapefruitOpen-source mobile security testing suite for iOS and Android. Previously Passionfruit
grapheneos/vanadiumPrivacy and security hardened Chromium build providing the WebView and default browser for GrapheneOS, with OS-level hardening and compatibility…
mitmproxy/mitmproxyAn interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers.
lief-project/liefCross-platform library to parse, modify, and abstract ELF, PE, and MachO executable formats. Supports C++, Python, and Rust APIs with disassembler,…
vmoranv/jshookmcpA search-first, profile-aware reverse-engineering workspace for AI agents — 735 tools across 36 domains in one MCP server.
vighnesh91/omnisec-hexBrowser-local security monorepo with six modules for mobile APK/IPA triage, client-side DAST fuzzing, OSINT directories, offline AI threat scoring,…
maximilianfeix/hexveroKnow what changed inside your Electron release: diff two builds for IPC, preload, windows, fuses and hosts, with file:line. CLI, CI gate, MCP server.
owasp/mastgComprehensive OWASP guide for mobile app security testing, reverse engineering, and verifying MASVS/MASWE weaknesses through static, dynamic, and…
frida/fridaMain repo for hosting release binaries
ejfkdev/ddcAndroid DEX → Java decompiler in Rust, built for speed — full apps in seconds, queries in milliseconds. Progressive analysis, javac-verified output,…
mitmproxy/mitmproxy_rsRust components for traffic interception and redirection, enabling WireGuard device proxying and local app redirection across macOS, Windows, and…
mg1937/ascFast Android APK decompiler front-end that queries compiled DEX artifacts directly, extracting classes and cross-references in milliseconds without…
amd2g2zz/kunglao-agentThe reverse-engineering expert agent: plans its own analysis path, derives every fact from raw evidence, and converges under mechanical verification…
httptoolkit/frida-interception-and-unpinningFrida scripts to rewrite mobile applications at runtime to directly MitM all HTTPS traffic
yv1ing/secboxConducting cybersecurity testing using the pi agent in a pre-built sandbox environment.
simoneavogadro/android-reverse-engineering-skillDecompiles Android APK/XAPK/JAR/AAR files and extracts HTTP APIs, authentication patterns, and call flows using jadx, with R8-resistant Kotlin name…
