Learn&Fuzz: Machine Learning for Input Fuzzing, 2017 arxiv.org

Complementing Model Learning with Mutation-Based Fuzzing, 2016 arxiv.org

Open Source Fuzzing Tools, 1st Edition amazon.com

(2007)

Fuzzing for Software Security Testing and Quality Assurance, 2nd Edition amazon.com

(2018)

Fuzzing: Brute Force Vulnerability Discovery, 1st Edition amazon.com

(2007)

DIFUZE: Interface Aware Fuzzing for Kernel Drivers, 2017 acmccs.github.io

Fuzzing Against the Machine: Automate vulnerability research with emulated IoT devices on QEMU a.co

(2023)

Frida frida.re

inject JavaScript to explore applications and a GUI tool for it

Xposed forum.xda-developers.com

equivalent of doing Stub-based code injection but without any modifications to the binary

Foresafe foresafe.com

Fireeye fireeye.ijinshan.com

max 60MB 15/day

Exploit Database exploit-db.com

click search

Exploit Database exploit-db.com

Vulnerability Google Doc docs.google.com

Dexter dexter.dexlabs.org

Devknox devknox.io

IDE plugin to build secure Android apps. Not maintained anymore.

Android's reported security vulnerabilities cvedetails.com

SPARTA cs.washington.edu

verifies (proves) that an app satisfies an information-flow security policy; built on the Checker Framework

CopperDroid copperdroid.isg.rhul.ac.uk

Contagio Mobile Malware Mini Dump contagiominidump.blogspot.com

Comdroid comdroid.org

vim syntax coloring for smali files codetastrophe.com

APK-Downloader codekiem.com

seems dead now

Android Security Evaluation Framework code.google.com

not under active development anymore

AXMLPrinter2 code.google.com

to convert binary XML files to human-readable XML files

androguard - Database Android Malware wiki code.google.com

FlowDroid blogs.uni-paderborn.de

Smali viewer blog.avlyun.com

DroidLegacy bitbucket.org

Indroid bitbucket.org

thread injection kit

Pithus beta.pithus.org

Open-Source APK analyzer. Still in Beta and limited to static analysis for the moment. It is possible to hunt malware with YARA rules. More here.

Wazuh wazuh.com

Volatility volatilityfoundation.org

tcpreplay tcpreplay.appneta.com

PyREBox talosintelligence.com

Stratus Red Team stratus-red-team.cloud

Shuffle shuffler.io

Shufflecake shufflecake.net

Security Onion securityonionsolutions.com

CodeQL securitylab.github.com

BadBlood secframe.com

Sandboxie sandboxie.com

terrascan runterrascan.io

Regula regula.dev

Atheris pypi.org

Polaris polaris.docs.fairwinds.com

PingCastle pingcastle.com

OwlH owlh.net

Open Source HIDS SECurity (OSSEC) ossec.net

OpenZITI openziti.github.io