Mobile OSINT Tools — Smartphone Investigation
Analyze mobile apps, identify excessive permissions, trace smartphone metadata and investigate mobile platforms. These tools cover APK analysis, stalkerware detection and phone OSINT.
29 tools · Version française
- Andriller (T)also written AndrillerPython-based Android forensics toolkit that extracts databases, decodes backup files and generates HTML reports from Android device data without root access.free
- APKLeaksalso written APK LeaksOpen-source tool that scans APK files for hardcoded secrets, API endpoints, and sensitive information.free
- APKtoolalso written AP KtoolOpen-source tool for reverse engineering Android apps. Decompiles APKs to extract resources and bytecode.free
- AutopsyOpen-source digital forensics platform. Extracts and analyzes data from mobile devices and disk images.free
- BlueStacks 2 (T)also written BlueStacks 2, Blue Stacks 2Free, lightweight Android emulator for desktop. Includes built-in forensic capabilities for data extraction from installed apps.free
- Charles Proxyalso written CharlesProxyCommercial HTTP/HTTPS proxy for traffic analysis. Captures and analyzes network traffic between apps and servers.paid
- Element (ex-Riot.im)also written Element (ex Riot im), Element(ex-Riot.im)Open-source Matrix client for decentralized messaging. Limited public data but useful for community monitoring.free
- Facebook (T)also written FacebookMajor social network with over 2 billion users. Primary target for social OSINT and profile reconnaissance.free
- FridaOpen-source dynamic instrumentation toolkit. Injects JavaScript to intercept and modify app behavior at runtime.free
- Genymotion (T)also written GenymotionCloud-based and desktop Android emulator platform for app testing and forensic analysis. Supports multi-instance deployment and integration with security testing tools.freemium
- JADXOpen-source decompiler (47k+ GitHub stars) that converts DEX bytecode to Java source code. GUI and CLI available.free
- Kik (T)also written KikMessaging app with 300M+ registered users. Public username search and profile visibility.free
- LINE (T)also written LINEMessaging app with 200M+ users, dominant in Asia. User search and public profile visibility.free
- Lynxio OSINTalso written LynxioOSINTMobile OSINT search tool for multi-identifier reconnaissance. Searches across phone numbers, email addresses, usernames, and social platforms.freemium
- MobSFalso written Mob SFOpen-source mobile security framework for static and dynamic analysis. Comprehensive vulnerability scanning and artifact extraction.free
- MVT (Mobile Verification Toolkit)Amnesty International's forensic toolkit for detecting compromise indicators (Pegasus-type spyware) on iOS and Android devices. Analyzes device backups and logs for known malicious indicators and forensic artifacts.free
- Nox App PlayerFree Android emulator with support for multiple Android versions and root access. Used for app analysis and testing.free
- OSINT Researcheralso written OSINTResearcheriOS app for GitHub organization reconnaissance and open-source intelligence. Limited to App Store distribution.free
- Periscope (T)also written PeriscopeLive video streaming app merged into Twitter. Limited standalone value; functionality integrated into Twitter.free
- Pinterest (T)also written PinterestVisual discovery platform with 460M+ users. Used for lifestyle, location, and interest-based profiling.free
- Signal Private Messenger (T)also written Signal Private MessengerEnd-to-end encrypted messaging app with 40M+ users. Limited OSINT value due to privacy-first design.free
- Snapchat (T)also written SnapchatEphemeral messaging app with 400M+ users. Limited historical data due to auto-deletion, but real-time activity visible.free
- SpyGuardalso written Spy GuardDetects stalkerware and compromise indicators by analysing a phone's network traffic from an independent access point. The maintained successor to TinyCheck, whose original repository has been removed.free
- Telegram (T)also written TelegramMessaging platform with 700M+ users. Extensive public data through public channels, groups, and user searches.free
- Twitter (T)also written TwitterMicroblogging platform with 500M+ users. Extensive public data, real-time information, and relationship networks. Requires a signed-in X account: without a session the URL bounces to the login screen.free
- Vine (T)also written VineShort-form video platform shut down by Twitter in January 2017. No longer operational.free
- WhatsApp Messenger (T)also written WhatsApp Messenger, Whats App Messenger, WhatsAppMessengerMessaging platform with 2B+ users. End-to-end encrypted, but profile data and metadata are accessible.free
- X-OSINTalso written X OSINTOpen-source multi-function OSINT framework optimized for Termux (Android) handling phone number investigation, email OSINT, VIN lookup, subdomain enumeration, and reverse lookups in a single mobile-friendly tool.free
- Yik Yak (T)also written Yik Yak, YikYakAnonymous location-based social network. Public posts visible by location, useful for community sentiment and event tracking.free
Frequently asked
- How to analyze a suspicious Android app?
- APKLab, MobSF (Mobile Security Framework) or VirusTotal can analyze an APK without installing it: permissions, network communications, suspicious code.
- What is stalkerware OSINT?
- It's the detection of hidden surveillance apps on a device. Tools like Coalition Against Stalkerware or Certo Mobile detect these malicious software.