Free open-source tool

AppSleuth, a mobile app security scanner

One tool for mobile app security triage. Point AppSleuth at an IPA, APK, APKS or AAB and get a scan, a one-page summary, a build-to-build diff and an audit of the data the app stores. Offline by default.

Runs on your own computer. Nothing is sent to us.

Recommended

Install with pipx

One command installs AppSleuth from PyPI. It uses only the Python standard library. For the experimental runtime checks, install it with the extra: pipx install "appsleuth[runtime]".

pipx install appsleuth

Source code

Get the tool from GitHub

The full source, the README, the tests and the MIT licence. Clone it and install it with pipx from the folder, or run it in place with python3 -m appsleuth.

git clone https://github.com/RansomWhisker/AppSleuth.git
cd AppSleuth
pipx install .

Get AppSleuth on GitHub

What it does

appsleuth scan app.ipa: Static security scan: secrets, App Transport Security or network security config, exported components, weak crypto, hardening and the hybrid web layer
appsleuth info app.apk: One-screen summary: identity, signing, permissions, exported components, libraries, what the app is built with and the protections it contains
appsleuth diff old new: Compare two builds and list the regressions: new risky settings, new findings, new hosts
appsleuth sbom app.apk: List embedded libraries as a CycloneDX SBOM; add --cves to look them up for known vulnerabilities
appsleuth endpoints app.ipa: Every host and API path the app references, with cleartext, raw-IP and staging hosts flagged
appsleuth links app.apk: Deep links, custom URL schemes, App Links and Universal Links
appsleuth cloud app.apk: Firebase, S3, Google Cloud Storage and Azure backends the app uses
appsleuth data: Pull an app's data container from your own device and audit what it stores
appsleuth runtime: Experimental: watch a running app with Frida (observe-only)

appsleuth app.ipa on its own is short for scan.

What you need

Your computer: macOS, Linux or Windows, with Python 3.9 or newer.
The app: an IPA, APK, APKS, XAPK or AAB. Pull one off your own phone with getIPA (iPhone) or getAPK (Android). Scan a decrypted IPA: AppSleuth can't see the code in an encrypted one, and says so.
Only for data and runtime: a jailbroken iPhone over SSH or an Android device over adb; runtime also needs frida-server on the device.

Only use AppSleuth on apps and devices you own or are authorised to test.

Quick start

Scan an app. The terminal shows the important findings; the full report is written as HTML, Markdown and JSON.

$ appsleuth scan com.example.shop.ipa -o report
com.example.shop 1.1  [IPA]
  [HIGH] App Transport Security disabled globally (NSAllowsArbitraryLoads=true)
        Info.plist NSAppTransportSecurity
  [MEDIUM] Main binary not compiled as PIE
        Shop
  [LOW] No stack-canary symbol found in main binary (heuristic)
        Shop
  … 3 lower-severity finding(s) in the report (use --show INFO to list)

1 High  1 Medium  1 Low  3 Info
Reports: report/report.html  report.md  report.json

Real output from a test app we built with deliberate weaknesses.

Handy options

--fail-on HIGH: scan: exit with code 3 if a finding at this severity or above remains
--fail-on-regression HIGH: diff: exit with code 4 if the new build has a regression at this level
-o DIR: Where to write report.html, report.md and report.json
--format json: Machine-readable output for scan and diff
--full: info: no truncation, plus every code location of each protection check
--show INFO: Print lower-severity findings too (LOW and above by default)
--min-confidence confirmed: Hide pattern-based (heuristic) findings
--ignore-file FILE: Your own suppression rules (.appsleuth-ignore by default)
--redact: data: mask found secret values in the report

How to use the result

What to do with the report

Start with High findings. Each finding has a severity, a confidence and the file it came from. Treat them as leads to check by hand, not confirmed vulnerabilities.
Check the secrets. A key found in an app can be read by anyone who has the app. Our note on mobile apps storing secrets locally explains what to look for.
Run diff on every release. appsleuth diff in your build pipeline catches a build that turns off transport security, adds a cleartext host or changes signer before it ships.
Test the API behind it. Static analysis shows what's in the app. Most serious findings are in the server it talks to, and that takes a person.

Background

Offline by default

AppSleuth reads the app file on your computer and sends nothing anywhere, with no telemetry. Three checks use the network, and only when you ask:

sbom --cves sends library names and versions, nothing else, to the OSV.dev vulnerability database. Results are cached for 24 hours.
links --check-network downloads the public app-link files (assetlinks.json, apple-app-site-association) of the domains the app claims.
cloud --check sends read-only, unauthenticated requests to the app's own cloud backends and records only the HTTP result, never the data. Use it only on apps you're authorised to test.

Keeping false positives low

Placeholder secrets are dropped, public client IDs are reported as information only, JWTs must decode, and cleartext URLs are played down when the platform already blocks cleartext. Add your own rules in .appsleuth-ignore. Nothing is silently lost: report.json lists everything that was demoted, dropped or ignored, and why.

App data is sensitive

appsleuth data shows found tokens and passwords in full so you can verify them, which makes its reports sensitive. Add --redact to mask them. Pulled files are extracted defensively and databases are opened read-only.

Responsible use

AppSleuth is for apps and devices you own or are authorised to test: your own apps, apps you're engaged to assess, and security research where the law allows.

FAQ

AppSleuth questions

Is AppSleuth free?

Yes. AppSleuth is free and open source under the MIT licence. Install it with pipx install appsleuth, or get the source from GitHub. It uses only the Python standard library.

Does it send my app anywhere?

No. AppSleuth runs on your own computer, has no telemetry and works offline by default. Three checks use the network only when you ask: sbom --cves sends library names and versions to the OSV.dev vulnerability database, links --check-network downloads the public app-link files of the domains the app claims, and cloud --check sends read-only requests to the app's own cloud backends. Nothing is ever sent to us.

Which files can it analyse?

iOS apps as IPA files, and Android apps as APK, split-APK bundles (APKS, XAPK) and Android App Bundles (AAB). Use getIPA or getAPK to pull an app off your own device first.

Are the findings confirmed vulnerabilities?

No. Findings are leads for a person to review. Each one has a severity and a confidence, AppSleuth filters common false positives, and report.json lists everything it demoted or dropped. A clean result on a still-encrypted IPA means nothing, because AppSleuth can't see its code: it warns you at the top of every report.

Can I run it in CI?

Yes. scan --fail-on HIGH exits with code 3 when a finding at or above that severity remains, and diff --fail-on-regression HIGH exits with code 4 when a new build gets worse. Both write JSON, Markdown and HTML reports.

Which apps can I use it on?

Only apps and devices you own or are authorised to test. The cloud --check option in particular sends requests to an app's backends, so use it only with permission.

Mobile App Penetration Testing (iOS & Android)

In-depth testing of your iOS and Android apps and the backend they talk to, aligned with OWASP MASVS.