Pillow==6.2.0

python3 xss2png.py -p <your payload> -o xss.png

a useful article about android and ios security with various resources (in Russian 'some resources are in English')

https://habr.com/en/companies/swordfish_security/articles/660179/?fbclid=IwY2xjawIQW3NleHRuA2FlbQIxMQABHZ3Scph3hott5AH6Xn756Ym_LTMVGYySo1r7jrgo6NpVRAZNMcNeRTFgFA_aem_d5dxt5cnAFrhHrdXkk1qzw

docker pull dwisiswant0/apkleaks:latest

pip3 install apkleaks

git clone https://github.com/dwisiswant0/apkleaks

cd apkleaks/

pip3 install -r requirements.txt

Wine (originally an acronym for "Wine Is Not an Emulator") is a compatibility layer capable of running Windows applications on several POSIX-compliant operating systems, such as Linux, macOS, & BSD. Instead of simulating internal Windows logic like a virtual machine or emulator, Wine translates Windows API calls into POSIX calls on-the-fly, eliminating the performance and memory penalties of other methods and allowing you to cleanly integrate Windows applications into your desktop.

APKWeaker is a command-line tool designed to simplify the process of modifying Android APKs for testing and debugging purposes It automates the process of pulling APKs from the Android emulator, decompiling them, injecting networkSecurityConfiguration into the base.apk if the application uses Split Packages to allow ClearTextTraffic (HTTP), forcing the application to trust a certificate (user, system), rebuilding the APKs, and signing them for reinstallation

Its functionality includes:
Checking the validity of a token
Testing for known exploits:
(CVE-2015-2951) The alg=none signature-bypass vulnerability
(CVE-2016-10555) The RS/HS256 public key mismatch vulnerability
(CVE-2018-0114) Key injection vulnerability
(CVE-2019-20933/CVE-2020-28637) Blank password vulnerability
(CVE-2020-28042) Null signature vulnerability
(CVE-2022-21449) Psychic Signature ECDSA vulnerability
Scanning for misconfigurations or known weaknesses
Fuzzing claim values to provoke unexpected behaviours
Testing the validity of a secret/key file/Public Key/JWKS key
Identifying weak keys via a High-speed Dictionary Attack
Forging new token header and payload contents and creating a new signature with the key or via another attack method
Timestamp tampering
RSA and ECDSA key generation, and reconstruction (from JWKS files)
Rate-limiting for all attacks
...and lots more!