Mobile Security Toolkit 📱

Android & iOS security testing tools — APK/IPA analysis, exported components, insecure storage, SSL pinning.

Tools

Tool	Platform	Checks
android_scanner.py	Android	APK analysis, manifest, exported activities, backups
ios_scanner.py	iOS	IPA analysis, plist, keychain, URL schemes

Installation

git clone https://github.com/ridhinva/Mobile-Security-Toolkit.git
cd Mobile-Security-Toolkit
pip install requests
# For APK analysis: apt install aapt (or android-sdk)

Usage

# Analyze Android APK
python3 android_scanner.py target.apk

# iOS app analysis
python3 ios_scanner.py app.ipa

How Each Scanner Works

Android Scanner

Decompiles APK files (via aapt or jadx) and inspects the AndroidManifest.xml for security misconfigurations: exported activities without permissions, debuggable flag, allowBackup=true enabling ADB data extraction, usesCleartextTraffic allowing HTTP, and insecure intent filters. Scans for hardcoded API keys, tokens, and other secrets in decompiled code.

iOS Scanner

Inspects IPA archives for security issues: Info.plist for insecure transport security (ATS exceptions), URL scheme hijacking potential, missing jailbreak detection, keychain data accessibility, and insecure NSUserDefaults storage. Checks for NSAllowsArbitraryLoads which disables ATS completely.

Author

Ridhin V A (@c_y_p_h3r)

Disclaimer

For authorized security testing and educational purposes only.