stodachon/snikrkit-web repository overview

A modern, GUI-first Android IPC security testing platform for penetration testers and mobile security researchers.

This is the SnikrKit web image — the frontend dashboard. Part of a 3-image stack (web + api + engine, plus PostgreSQL and Redis) — see below for full setup.

⁠SnikrKit — Web Dashboard

SnikrKit is a modern, GUI-first Android IPC security testing platform for penetration testers and mobile security researchers — a modern alternative to tools like drozer, inspired by the usability of MobSF.

This image is the frontend service. SnikrKit is a three-service stack (web, api, engine) plus PostgreSQL and Redis — it is not meant to run standalone. Use the provided docker-compose.yml to run the full stack.

⁠Quick setup

git clone https://github.com/stodachon/snikrkit
cd snikrkit/infra
docker compose -f docker-compose.prod.yml up -d

Visit http://localhost:3000. On first run, check docker compose logs api for the auto-generated operator password.

⁠What SnikrKit does

• Static APK analysis (manifest, permissions, exported components) via Androguard
• Interactive IPC testing — Activities, Services, Broadcast Receivers, Content Providers — via ADB
• Runtime instrumentation via Frida, live-streamed to the browser
• JADX-powered deep static analysis for Content Provider path discovery
• Automated candidate vulnerability detection, findings, evidence, and exportable reports

Every automated action shows the real adb/Frida command being executed — SnikrKit never hides the underlying Android mechanics.

⁠Related images

• stodachon/snikrkit-api⁠ — backend API
• stodachon/snikrkit-engine⁠ — Android security engine

⁠Links

• GitHub: https://github.com/stodachon/snikrkit⁠
• License: GPLv3