Droid LLM Hunter is an automated security analysis tool designed to detect vulnerabilities in Android applications with high precision. By combining traditional static analysis (SAST) with the contextual understanding of Large Language Models (LLMs), it bridges the gap between keyword-based scanning and human-like code review.
It supports Hybrid Decompilation (Smali/Java), Context-Aware Analysis (Call Graphs), and Intelligent Risk Filtering, ensuring that security engineers can focus on verified, high-severity findings rather than false positives.
Features Auto-Exploit Generation, transforming from a passive scanner into an active Red Team Assistant capable of verifying vulnerabilities with generated Proof-of-Concept (PoC) scripts.
Dashboard Report Droid-LLM-Hunter - web interface to visualize and manage security analysis reports. Link: dashboard-report-dlh
VulnerAppDLH - a vulnerable Android application created specifically to test Droid-LLM-Hunter. Link: VulnerAppDLH
Tutorial Install Droid LLM Hunter
|
WebView via DeepLink - Exported Components
|
- ✨ Features
- 🔄 Scan Workflow
- 🛡️ Available Rules
- ⚙️ Configuration
- 🔩 Installation
- 💡 Usage
- 🔁 CI/CD Integration
- 🚀 Development Roadmap
- ❓ FAQ
- 🤝 Contributing
Droid LLM Hunter combines static analysis with LLM intelligence to detect Android vulnerabilities with high precision. Key capabilities include Staged Prompt Architecture, Hybrid Filter Modes, Call Graph Context Injection, OWASP MASVS enrichment, and Auto-Exploit Generation across 6 LLM providers.
Multi-stage pipeline: Decompilation → Scope Filter → Risk Identification → Deep Scan → Global Context → Chained Exploit → Report.
→ View Full Pipeline Diagram & Explanation
Hardcoded Secrets
|
SQL Injection - Generate-Exploit
|
25 vulnerability rules covering SQL Injection, WebView XSS, Hardcoded Secrets, Intent Spoofing, Path Traversal, Insecure Deserialization, and more — all mapped to OWASP MASVS.
| Setting | Options | Recommended |
|---|---|---|
filter_mode |
llm_only, static_only, hybrid |
hybrid |
decompiler_mode |
apktool, jadx, hybrid |
hybrid |
provider |
ollama, gemini, groq, openai, anthropic, openrouter |
anthropic / gemini |
→ View Full Configuration Guide
git clone https://github.com/roomkangali/droid-llm-hunter.git
cd droid-llm-hunter
pip install -r requirements.txtRequires: Python 3.11+, Apktool, and optionally JADX.
→ Full Installation Guide (including Docker)
python dlh.py scan target.apk
python dlh.py scan target.apk --generate-exploit
python dlh.py -v --rules "sql_injection,webview_xss" scan target.apk→ Full Usage Guide & Command Reference
Supports GitHub Actions and GitLab CI. Returns exit code 1 on scan failure for automated quality gates.
→ View CI/CD Integration Guide
Next major version (v2.0) targets AI-Powered Dynamic Analysis with Frida & ADB integration, Taint Analysis Engine, and De-obfuscation Support.
→ View FAQ
🤝 Contributions are welcome! Please create an issue or pull request to report bugs or add new features.
While Droid LLM Hunter uses Context Awareness and Smart Filtering to minimize noise, LLMs are inherently probabilistic and may occasionally hallucinate or misidentify vulnerabilities. Treat all results as leads requiring manual verification. This tool is built to augment human analysis not replace it.