A cross-platform static code analysis tool for mobile applications (APK/IPA) to find security vulnerabilities like hardcoded credentials and API keys.
StaCoAn is a static code analysis tool for mobile applications that scans decompiled APK and IPA files to identify security vulnerabilities. It searches for hardcoded credentials, API keys, URLs, decryption keys, and major coding mistakes, generating visual, portable reports to aid in security assessments.
Mobile application developers, bug bounty hunters, and ethical hackers who need to perform security audits on Android and iOS applications.
It offers an intuitive drag-and-drop interface with customizable wordlists and visual reports, making static analysis more accessible compared to traditional command-line tools.
StaCoAn is a crossplatform tool which aids developers, bugbounty hunters and ethical hackers performing static code analysis on mobile applications.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Users can simply drag APK files onto the tool to generate visual reports, eliminating command-line complexity as shown in the Windows one-click demo.
Supports regex-based wordlists to search for patterns like API keys and credentials, allowing tailored scans for specific security issues.
Generates self-contained, responsive HTML reports that can be exported as ZIP files for easy sharing, demonstrated in the example report.
Runs on Windows, macOS, and Linux via pre-built executables or Docker, making it widely accessible without source code modifications.
The project is marked as 'alpha' and explicitly stated as not maintained, meaning no bug fixes, updates, or support for future issues.
Advertised for IPA files but only APK is functional, with IPA support lingering in the roadmap and unimplemented, limiting its utility for iOS apps.
The README admits the tool has trouble with obfuscated code, reducing effectiveness on secured applications and requiring workarounds.