Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.

The OWASP MASVS (Mobile Application Security Verification Standard) is the industry standard for mobile app security.

APKHunt is a comprehensive static code analysis tool for Android apps that is based on the OWASP MASVS framework. Although APKHunt is intended primarily for mobile app developers and security testers, it can be used by anyone to identify and address potential security vulnerabilities in their code.

Modern offline-first Application Security Intelligence Platform for Android, iOS, Flutter and React Native with attack-chain analysis, explainable findings, source exploration, AI-assisted investigation and professional reporting.

A tool capable of bypassing easy root detection mechanisms by patching applications automatically (without frida).

OWASP Thick Client Application Security Verification Standard

Nutcracker is a powerful, modular and extensible framework designed for mobile security analysis and offensive threat intelligence. Detects and bypasses anti-root/RASP protections, analyzes insecure manifest conf, extracts hardcoded secrets and launches OSINT recon — all in one tool. aligned with MASVS for comprehensive security compliance.

Mobile Application Security Design Guide

Assessors Studio operationalizes CycloneDX Attestations (CDXA): perform assessments, collect evidence, make claims, and issue machine-readable CycloneDX attestations, optionally legally binding for B2B and B2G use cases.

Claude Code skills and MCP servers for Android APK reverse engineering

NutBank is an intentionally vulnerable Android app designed for security research and mobile pentesting demos. Built to showcase nutcracker's RASP bypass capabilities. Features hardcoded secrets, insecure components, and real RASP protections (RootBeer, Frida detection, emulator detection) that nutcracker can detect and bypass.

Automated iOS SAST/DAST framework — the iOS counterpart of TrashDroid. libimobiledevice + SSH-over-USB + Frida/objection; 13-phase static+dynamic assessment with AI-ready reports.

Mobile Security Intelligence Platform - Transform mobile app security scans into actionable intelligence with static/dynamic analysis, framework detection, and OWASP MASVS mapping

Codex skill for evidence-based OWASP MASVS mobile app security reviews.

Android APK static security analyzer — MASTG-aligned, from-scratch binary-AXML decoder, zero dependencies.

Engagement authorization & scope enforcement for authorized mobile security testing (signed scope, ROE gating, tamper-evident audit log).

Self-hostable, open-source Android app-security training platform — every task auto-graded on a real Android emulator, aligned to OWASP MASVS/MASTG.

Web tool en Python para los controles de MASVS-Resilience

Enable organizations to create, manage, and issue CycloneDX machine-readable attestations for structured software transparency and compliance.