Color: Red team / AppSec.
What Is This Category?
Mix (10 tools)
- License: 6 open source · 4 proprietary
- Hosting: 6 self-hosted · 3 SaaS · 1 both
Mobile Application Security Testing covers the per-app security review for iOS and Android. Distinct from MTD (which protects mobile devices), MAST looks at a specific app: static analysis of the binary, dynamic instrumentation while the app runs, traffic inspection, and storage / permission auditing. The OWASP MASVS / MASTG standards define the testing methodology.
Distinct from neighbouring categories
- Mobile Threat Defense (MTD) – MTD protects the mobile device at runtime; MAST audits the app at build / test time
- Code Quality / SAST / DAST – Code quality / SAST is source-language scanning; MAST is binary + runtime scanning of shipped APK / IPA
- Vulnerability Management – VM scans network assets; MAST scans installed mobile apps
About this data & disclaimer
The information on these pages was researched by a combination of human review and large language models. This catalogue serves as a reference for the resources, applications, devices, deployment payloads, and other components that the ResorsIT platform integrates, deploys, and manages. To suggest an addition or correction, please contact us. Prepared by Rhodium Systems Inc., author of the ResorsIT platform — a unified IT operations management platform for IT teams and MSPs that integrates a curated suite of open-source, commercial, and SaaS applications into a single system with shared identity, single sign-on, access control, and a common audit trail. This information is compiled on a best-effort basis: it may be incomplete, contain errors, and become out of date as tools, vendors, licences, and features change. Use this catalogue only as a starting point for your own research, and independently verify and review any tool carefully against your own requirements before relying on it.
Comparison
Overview
Mobile AppSec splits between methodology + OSS analyst tools (OWASP MASTG / MASVS standard + MobSF + Frida + Drozer + jadx + apktool) and commercial testing platforms (NowSecure, AppKnox, Zimperium zScan) plus a separate app shielding category (Verimatrix App Shield).
Capability Matrix
| Tool | Static | Dynamic | Network | MASVS-Mapped | CI/CD |
|---|---|---|---|---|---|
| MobSF | yes | yes | partial | partial | yes |
| Frida + Objection | – | yes (first-class) | – | – | – |
| Drozer | partial | yes (IPC) | – | – | – |
| jadx | yes (decomp) | – | – | – | – |
| apktool | yes (decode + rebuild) | – | – | – | – |
| OWASP MASTG/MASVS | n/a | n/a | n/a | yes (the standard) | – |
| NowSecure | yes | yes | yes | yes | yes |
| AppKnox | yes | yes | yes | yes | yes |
| Zimperium zScan | yes | yes | yes | yes | yes |
| Verimatrix App Shield | shielding (not testing) | runtime RASP | – | – | yes (build-pipeline) |
License Comparison
| Tool | License | OSI | Type |
|---|---|---|---|
| MobSF | GPL-3.0-only | yes | OSS platform |
| Frida + Objection | wxWindows | yes | OSS library + helper |
| Drozer | BSD-3-Clause | yes | OSS framework |
| jadx | Apache-2.0 | yes | OSS decompiler |
| apktool | Apache-2.0 | yes | OSS reverse-engineering |
| OWASP MASTG/MASVS | CC-BY-SA-4.0 | yes | OSS methodology / standard |
| NowSecure | Proprietary | – | Commercial SaaS + on-prem |
| AppKnox | Proprietary | – | Commercial SaaS |
| Zimperium zScan | Proprietary | – | Commercial SaaS |
| Verimatrix App Shield | Proprietary | – | Commercial SDK + SaaS |
Composition Patterns
1. OSS pentest engagement
OWASP MASVS -- scoping framework / control list
OWASP MASTG -- per-test procedure guide
MobSF -- automated static + dynamic platform
Frida + Objection -- in-process dynamic analysis
Drozer -- Android IPC surface enumeration
jadx + apktool -- decompile / rebuild Android APKs
+ Burp / mitmproxy -- traffic interceptionOutput: full mobile-pentest toolkit at zero license cost. A standard OSS engagement stack.
2. Customer-managed automated testing
NowSecure (or AppKnox / Zimperium zScan)
Output: automated CI / CD-integrated MASTG-aligned testing. For customers wanting continuous testing rather than one-shot pentest engagements.
3. High-value-app protection layer
Verimatrix App Shield -- code obfuscation + RASP for shipped binary
+ MASTG testing -- still test the app despite shieldingOutput: app-hardening + testing combined for banking / DRM / streaming apps where active runtime protection matters.
Tools
10 tools.
apktool
Connor Tumbleson’s reverse-engineering tool for Android APK files; decode resources, rebuild modified APKs, smali assembler / disassembler.
License: Apache-2.0 (OSS) · Kind: cli · Deploy: direct, package · SSO: none
ResorsIT usage: Deployment Payload
Access & Identity: Local host account · Key-based access
AppKnox
Indian commercial mobile-AppSec platform; automated static / dynamic / API testing; alternative to NowSecure for Indian / Asian markets.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on · Provisioned account
Drozer
WithSecure Labs’s (formerly MWR Labs) Android security testing framework; explore Android IPC + permissions interactively.
License: BSD-3-Clause (OSS) · Kind: cli · Deploy: direct, package · SSO: none
ResorsIT usage: Deployment Payload
Access & Identity: Local host account · Key-based access
Frida + Objection
Ole Andre Vadla Ravnaas’s dynamic instrumentation framework + Sensepost’s Objection helper; the canonical OSS mobile / desktop dynamic-analysis toolkit.
License: wxWindows (OSS) · Kind: library · Deploy: direct, package · SSO: none
ResorsIT usage: Library
jadx
skylot’s Java decompiler with first-class Android APK / dex support; the canonical OSS Android decompilation tool.
License: Apache-2.0 (OSS) · Kind: desktop · Deploy: direct, package · SSO: none
ResorsIT usage: Deployment Payload
Access & Identity: Vaulted credential · Local host account
MobSF
Open-source mobile app security framework; static and dynamic analysis of Android APK and iOS IPA / Windows AppX in one platform.
License: GPL-3.0-only (OSS) · Kind: web · Deploy: docker, direct · SSO: OIDC
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on
NowSecure
Commercial mobile-AppSec platform; automated MASTG-aligned testing of iOS / Android apps; long-standing market leader.
License: Proprietary (proprietary) · Kind: web · Deploy: saas, direct · SSO: OIDC, SAML
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on · Provisioned account
OWASP MASTG / MASVS
OWASP Mobile Application Security Testing Guide + Verification Standard; the canonical mobile-AppSec testing methodology + verification framework.
License: CC-BY-SA-4.0 (OSS) · Kind: library · Deploy: direct · SSO: none
ResorsIT usage: Library
Verimatrix App Shield
Verimatrix’s commercial mobile-app shielding + threat-detection platform; code obfuscation + RASP + threat analytics; premier-tier for high-value apps.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on · Provisioned account
Zimperium zScan
Zimperium’s commercial mobile-AppSec platform; sibling to Zimperium MTD (see tools/mtd/zimperium.md); shared threat-intelligence corpus.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on · Provisioned account
