Appknox vs SEBASTiAn

Appknox is a mobile application security testing platform for Android and iOS apps. It combines automated vulnerability assessment, penetration testing, software bill of materials generation, and app store monitoring. Automated assessment includes static analysis, dynamic analysis, and API security testing; users can start by uploading an app binary without providing source code. It supports apps made with Flutter, React Native, Xamarin, and Ionic. Teams can run scans, retrieve reports, and manage security operations through a command-line tool and public APIs. Listed integrations include Azure Pipelines, Jenkins, CircleCI, App Center Build, Bitbucket Pipelines, Bitrise, GitHub Actions, GitLab, and ArmorCode. Findings can be mapped to frameworks including GDPR, PCI-DSS v4.0, HIPAA, NIST, SAMA, DORA, CWE, and OWASP standards. Appknox offers on-premise and private-cloud deployment for local data residency needs. It says scans of the same app are unlimited, with pricing based on the number of unique apps assessed. Pricing is on request, and a free trial is available.

SEBASTiAn is a self-hosted tool for static security assessment of Android APK and iOS IPA applications. It runs on Linux, macOS, and Windows, and can generate a unified JSON report with vulnerabilities, remediation suggestions, further reading, and the location of vulnerable code or configuration. Android checks include insecure networking, cryptography, permissions, exported components, and WebView configuration. iOS checks cover binary encryption and signatures, insecure APIs and TLS settings, weak cryptography, and memory-protection flags. The project describes the tool as modular and extensible, and offers running it from source or using its official Docker image. The command-line option --generate-report saves identified vulnerabilities as JSON, with reports available in English or Italian. The default analysis timeout is 1,200 seconds, and users can change it. Installation guidance requires Python 3 and CMake; Python 3.12 or later may require manually installing LIEF. The AGPL-3.0 open-source plan is free for open-source projects. Commercial or closed-source use requires a commercial license, with pricing not listed.