ImmuniWeb MobileSuite is a mobile application penetration testing platform that combines machine learning technology with manual security testing. The platform provides comprehensive security assessment for both mobile applications and their backend infrastructure including APIs and web services. The tool offers multiple testing packages ranging from basic Express Pro to comprehensive Ultimate packages, with varying levels of OWASP MASVS and ASVS compliance testing. It supports testing of iOS and Android applications built with various frameworks including Xamarin and Flutter. Key features include static, dynamic, and interactive security testing with software composition analysis, business logic testing, and authenticated testing capabilities with MFA/SSO support. The platform can bypass resilience mechanisms such as root detection, jailbreak detection, SSL pinning, and code obfuscation. Testing methodology follows industry standards including OWASP Mobile Security Testing Guide, NIST SP 800-115, PCI DSS penetration testing guidance, and MITRE ATT&CK frameworks. The platform provides coverage for OWASP Mobile Top 10, SANS Top 25, and various compliance requirements. Reports include threat-aware risk scoring, MITRE ATT&CK matrix mapping, CVE and CWE mapping, CVSS v4 and EPSS v4 scoring, and detailed remediation guidelines. The platform offers unlimited patch verification, DevSecOps integrations, and 24/7 access to security analysts. The service includes network security assessment for mobile backend infrastructure, privacy and encryption analysis, and can perform testing on physical devices when required. Integration capabilities include popular DevSecOps tools, issue trackers, and WAF solutions for virtual patching.
FEATURES
EXPLORE BY TAGS
SIMILAR TOOLS
A plugin for viewing, detecting weak configurations, and generating Content Security Policy headers.
APKiD is a tool that identifies compilers, packers, obfuscators, and other weird stuff in APK files.
A brute-force protection middleware for express routes that rate-limits incoming requests.
A source code search engine for searching alphanumeric snippets, signatures, or keywords in web page HTML, JS, and CSS code.
QIRA is a competitor to strace and gdb with MIT license, supporting Ubuntu and Docker for wider compatibility.
A PHP port of Rack::Honeypot, a spam trap that detects and blocks spambots
A software composition analysis tool that identifies vulnerabilities, malicious code, and license risks in open source dependencies throughout the software development lifecycle.
A Java API for searching and downloading Android applications from Google Play with additional check-in features for generating ANDROID-ID.
A GitHub application that performs automated security code reviews by analyzing contextual security aspects of code changes during pull requests.
PINNED

Checkmarx SCA
A software composition analysis tool that identifies vulnerabilities, malicious code, and license risks in open source dependencies throughout the software development lifecycle.

Orca Security
A cloud-native application protection platform that provides agentless security monitoring, vulnerability management, and compliance capabilities across multi-cloud environments.

DryRun
A GitHub application that performs automated security code reviews by analyzing contextual security aspects of code changes during pull requests.