Real-time telemetry, live memory forensics, one-click bypasses, and executive-ready reporting — all from one dashboard.
WTFAndroid is a cutting-edge, hybrid Static + Dynamic Mobile Application Security Testing (MAST) framework. Built for security researchers, penetration testers, and DevSecOps teams, it pairs an intuitive web dashboard with an asynchronous Python engine and Frida instrumentation to bridge the gap between:
- Static analysis — hardcoded secrets, misconfigurations, and vulnerable permissions
- Dynamic analysis — live memory dumping, Logcat monitoring, API hooking, and automatic security-evasion bypasses
- Why WTFAndroid?
- Features
- Architecture & Tech Stack
- Prerequisites
- Installation & Setup
- Usage Guide
- Troubleshooting
- Strategic Value
- Roadmap
- Resources & References
- Disclaimer
- Contributing
- License
The mobile application security testing landscape has several established tools — but each carries real limitations:
| Tool | Limitation |
|---|---|
| MobSF | Primarily static-focused; dynamic analysis depends on specific Android-x86 emulator setups that are difficult to maintain, with no granular real-time telemetry or live memory forensics. |
| Drozer | Strong for IPC/attack-surface discovery, but requires an on-device agent app, has seen limited updates for Android 12+, and lacks automated root/SSL-pinning bypasses. |
| Frida (standalone CLI) | The industry standard for instrumentation, but requires hand-writing custom JS/Python bindings per engagement, with no out-of-the-box GUI for visualization or correlation. |
WTFAndroid addresses these gaps directly:
- Real-Time Telemetry & Logcat Streaming — WebSockets stream Frida hooks and Logcat data straight to the dashboard, instead of requiring manual log pulls.
- Hardware-Agnostic Dynamic Analysis — connects to any physical device or emulator (Genymotion, Android Studio AVD, physical USB) running
frida-server, no specialized VM required. - Live RAM Memory Forensics — scan the read-write heap of a running app for exposed secrets (JWTs, API keys, plaintext passwords) with one click.
- Seamless Bypasses — auto-configurable toggles for SSL certificate pinning and root-detection bypasses, right from the dynamic analysis dashboard.
- Modular Export Capabilities — granular exports of live Logcat streams, memory dump CSVs, and comprehensive PDF reports.
- Automated manifest parsing, string-resource extraction, and permission analysis
- Hardcoded secrets detection and certificate verification
- Calculated Threat Index Score with OWASP Mobile Top 10 mapping
- Frida-based runtime instrumentation via a custom JS agent (
core_hooks.js) - Live telemetry and Logcat streaming over WebSockets
- One-click SSL pinning and root-detection bypasses
- Live RAM/heap scanning for exposed secrets
- Executive-ready PDF report generation
- Logcat stream and memory dump CSV exports
- Findings mapped to OWASP Mobile Top 10 categories for easy remediation tracking
WTFAndroid uses a modern, decoupled architecture for scalability and responsiveness:
| Layer | Technologies |
|---|---|
| Frontend | Vanilla JavaScript, HTML5, TailwindCSS (utility-first, dark-mode UI), native WebSockets for live telemetry |
| Backend (Orchestration Engine) | Python 3.10+, FastAPI (async REST + WebSocket endpoints), Uvicorn (ASGI server) |
| Instrumentation Layer | Frida-Python bindings communicating with core_hooks.js, a custom JS agent injected into the target process memory |
Before installing WTFAndroid, make sure your environment meets the following requirements:
- ✅ Python 3.10 or higher
- ✅ ADB (Android Debug Bridge) installed and added to your system
PATH - ✅ A rooted physical Android device, or an emulator (Android Studio AVD, Genymotion)
- ✅
frida-serverinstalled and running on the device, matching your host's Frida version
1. Clone the repository and navigate to the backend directory
git clone https://github.com/YourUsername/WTFAndroid.git
cd WTFAndroid/backend2. Install the required Python dependencies
pip install -r requirements.txt3. Start the FastAPI backend server
uvicorn app.main:app --reload --host 127.0.0.1 --port 8000OR
PYTHONPATH=. ./venv/bin/python3 -W ignore::SyntaxWarning -m uvicorn app.main:app --host 127.0.0.1 --port 8000 --reload4. Access the dashboard
Open your browser and navigate to:
http://127.0.0.1:8000
Drag and drop an .apk file into the dashboard. The static engine will automatically:
- Parse the manifest and string resources
- Extract hardcoded secrets
- Verify certificates
- Generate a Threat Index Score
- Ensure your Android device is connected via ADB and
frida-serveris running as root. - Enter the target package name (e.g.
com.example.app) in the Dynamic Audit tab. - Toggle SSL Pinning Bypass or Root Detection Bypass as needed.
- Click Launch Pipeline to hook the application and start streaming live telemetry and Logcat data.
- Use Scan RAM & Dump Secrets to search for sensitive tokens in the live heap.
| Issue | Resolution |
|---|---|
frida-server daemon is not running on the target device |
Verify the ADB connection with adb devices. Ensure frida-server has been pushed to /data/local/tmp/ and started via adb shell with root privileges. |
| Pipeline connection refused | Confirm the FastAPI daemon is running in your terminal and that your browser is pointed at the correct host/port. |
| Memory dump returns 0 artifacts | Actively use the target app (log in, trigger API calls) so secrets are populated in RAM before starting the scan. |
WTFAndroid isn't just a vulnerability scanner — it's a collaborative platform for DevSecOps:
- For pentesters: drastically cuts time spent writing boilerplate Frida scripts, freeing up time for business-logic flaws and complex API tampering.
- For organizations: PDF and CSV export capabilities enable seamless integration of findings into Jira or other remediation-tracking systems.
- For red teams: the transparent
core_hooks.jsagent (unlike black-box commercial tools) can be extended to bypass proprietary obfuscation or custom crypto implementations.
- iOS Support — extend the orchestrator with
frida-ios-dumpand Objective-C hooking for cross-platform analysis - Automated Intent Fuzzing — generate Drozer-like payloads to automatically fuzz exported activities from the browser
- Cloud-Native Deployment — Dockerize the backend for distributed teams connecting to remote Android device farms
WTFAndroid is developed strictly for educational purposes, authorized security research, and legal penetration testing. You may only use this framework on applications and systems you own or have explicit, written permission to audit. The developers assume no liability and are not responsible for any misuse or damage caused by this program.
Contributions, issues, and feature requests are welcome! Feel free to check the issues page.
This project is licensed under the MIT License.