What is selimdroid?

SelimDroid is an open source security testing tool built for Android apps. It falls into a category called DAST, which stands for Dynamic Application Security Testing: instead of just reading an app's code, it watches and interacts with the app while it is actually running on a phone or emulator. The tool connects to a rooted Android device using ADB (Android Debug Bridge) and Frida, a runtime instrumentation toolkit that lets it hook into a live app and inspect what it is doing. Once connected, SelimDroid runs a series of automated checks: it looks for sensitive data stored insecurely in local databases or shared preferences, scans system logs and the clipboard for leaked information, tests whether the app properly detects rooted devices, and attempts to bypass SSL pinning, a common defense against network traffic interception. It also checks exported app components, content providers, and WebViews for common security holes. A notable feature is its post logout validation: after a user logs out of the tested app, SelimDroid checks whether session tokens, cached data, and database records were actually cleared, rather than assuming the logout worked. Some checks need the person running the scan to interact with the app directly, such as logging in, copying something to the clipboard, or moving through a WebView, the tool pauses and prompts for these actions when needed. After a scan finishes, SelimDroid produces a single combined report listing everything it found, saved to a reports folder. To run it, you need Python 3.9 or newer, Frida and its server component, ADB, and a rooted Android device or emulator with USB debugging turned on. This is a specialist tool aimed at security researchers and penetration testers, not general app developers. The author states it is meant only for authorized testing, security research, and educational use, and should not be run against apps or systems without permission.