This project is currently just the tip of the iceberg of the planned project. If you are interested in this project or want to participate in the subsequent development or translation work, please send an email to [email protected] explaining your capabilities and requirements.
AppInfoScanner
A mobile (Android, iOS, WEB, H5, static website) information gathering and scanning tool designed for HW operations/red team/penetration testing team scenarios. It helps penetration test engineers, attack team members, and red team members quickly collect key asset information from mobile apps or static WEB sites and provides basic information output, such as: Title, Domain, CDN, status information, etc.
The developer of this project is currently an individual developer who also has a full-time job. New features or requirements will be developed in spare time, and BUGs will be prioritized.
If you encounter problems during use or have new requirements, please submit BUG feedback in issues. Please read the "FAQ" at the end before submitting a BUG.
If you find this project useful, please click the "star" button in the upper right corner of this project.
If you want to keep up with new version updates, please click the "Watch" button in the upper right corner of this project.
If you want to participate in the development of this project, please click the "Fork" button in the upper right corner of this project; otherwise, please do not click the "Fork" button.
Disclaimer
Please do not apply the technology or code of this project to illegal purposes such as malware creation, software copyright/intellectual property theft, or improper profit-making. Carrying out the above behaviors or using this project to sniff data from programs whose copyright you do not own will be suspected of violating Article 217 and Article 286 of the Criminal Law of the People's Republic of China, the Cybersecurity Law of the People's Republic of China, the Regulations on the Protection of Computer Software of the People's Republic of China, and other legal provisions. The technology mentioned in this project can only be used in legal scenarios such as private learning and testing. Any criminal or civil liability caused by improper use of this technology has nothing to do with the author of this project.
Applicable Scenarios
Collecting key asset information from APPs during daily penetration testing, such as the collection of URL addresses, IP addresses, keywords, etc.
Collecting key asset information from APPs in large-scale attack-defense exercise scenarios, such as the collection of URL addresses, IP addresses, keywords, etc.
Collecting information from WEB website source code (which can be open-source code or source code saved as a webpage).
Collecting URL addresses, IP addresses, keywords, and other information from H5 pages.
Conducting targeted information collection for a specific APP, etc.
Feature Introduction:
Supports batch scanning at the directory level
Supports information collection from files such as DEX, APK, IPA, Mach-O, HTML, JS, Smali, etc.
Supports automatic download and one-click information collection for files such as APK, IPA, H5, etc.
Supports custom request headers, request bodies, and request methods
Rule customization: workspace config.toml
Supports custom ignored resource files
Android hardening detection: unified signature library identification and detection of hardening vendors
CVE/RCE component detection: supports detection of 20 Android app and 22 iOS app CVE and RCE components
Sensitive permission detection: supports detection of 49 Android app and 22 iOS app highly sensitive permissions
Sensitive credential (AK/SK) detection: comprehensively covers detection of common credentials such as Alibaba Cloud/Tencent Cloud/AWS/Google/GitHub/GitLab/Slack/Stripe/JWT/private keys/passwords embedded in URLs, etc.
Personal/enterprise sensitive information detection: supports detection of sensitive information such as phone numbers/ID cards/emails/bank cards/license plates/names/passports/VIN/IMEI/unified social credit codes, etc.
Common protocol collection: supports collection of common protocols such as http(s)/ws/jdbc/redis/mysql, etc.
Basic network sniffing: supports sniffing of basic information such as status codes/titles/Server/CDN/resolved IPs (explicitly enabled with --sniffer, authorized scope limited with --scope)
Multiple output file categories: supports output of result files such as json, txt, xlsx, etc.
Internationalization support: automatically outputs prompts in Chinese/English and other languages according to the system language
Compatible with mainstream operating systems such as Windows/macOS/Linux
Supports automatic repair of APK file magic numbers
Component version detection: extracts component version numbers and gives affected/safe conclusions against CVE impact ranges
Authorized sniffing: supports domain list files to limit the sniffing scope (--scope)
Automatic update: supports automatic update via detection/download/MD5 verification from GitHub Release (update subcommand)
Configuration version management: config.toml carries a version number, automatically migrates across version upgrades, and retains user-defined rules
ELF/.so and Flutter (libapp.so) parsing, support for parsing installation packages such as HarmonyOS/Pengpai OS
AI Agent integration (MCP Server/--agent mode/structured output contract)
Partial Screenshots
Environment Description
Python 3.11+ runtime environment (verified on 3.14)
Dependent toolchain and versions (automatically installed on macOS/Linux when missing; on Windows, use the binaries bundled with the repository or install manually):
Tool
Version
Acquisition Method
Java
11+ (verified with Zulu 11)
Manual installation on Windows; automatic installation via brew/apt etc. on macOS/Linux
adb
current version of platform-tools
Bundled with the repository tools/unpacker on Windows; automatically installed when unpacking is triggered on macOS/Linux
frida
17.18.0
Installed via pip, kept consistent with the device-side frida-server version
frida-tools
14.10.4
Installed via pip
frida-dexdump
2.0.1
Installed via pip
apktool
3.0.3
Bundled with the repository tools/apktool.jar, automatically deployed in the workspace
kelvinben/appinfoscanner
