Quixxi Scan vs Reversense Security

Quixxi Scan assesses Android and iOS app security through static and dynamic analysis, with recommendations for addressing vulnerabilities. SAST analyzes apps to identify risks, explain them and suggest fixes; automated continuous scanning can be integrated into a CI/CD pipeline. DAST examines app behavior, including SSL pinning, root detection, sensitive data, endpoint identity, encryption, copy and paste, and screenshots. A separate API Scan checks for issues such as injection attacks, authentication flaws, cross-site scripting and insecure direct object references. The service runs in the cloud and is available on Android, iOS and the web. The site offers a free SAST trial and a free app scan link, but does not state a trial duration. One-off SAST and API scans cost $29 as a one-time purchase; DAST costs $199, paid once. Monthly SAST and API scans cost $49 a month. The pricing article says there is no unlimited monthly DAST plan, and custom plans can be based on selected apps and modules. Quixxi says the product aligns with GDPR guidelines, addresses OWASP Mobile Top 10 risks, assists with PCI DSS requirements and incorporates NIST practices.

Reversense Security analyzes mobile and embedded application binaries without requiring source code or manual reverse engineering. It can assess binaries and packaged apps from app stores or CI/CD pipelines, using IAST and fuzzing to uncover exploitable vulnerabilities and runtime attack paths. Its Dexcalibur engine combines static, dynamic, and symbolic analysis for deobfuscation and tailored investigations, including highly obfuscated apps. An integrated Dalvik virtual machine supports symbolic and concrete execution of bytecode that needs implicit context. Teams can monitor application-level network traffic, including HTTPS, without changing device network settings or bypassing SSL pinning; they can also monitor and tamper with application-level NFC commands. Multiple devices and apps can be instrumented within one project. Other functions include automated privacy reports for Android and iOS against GDPR, CRA, PCI, and CCPA referentials, and digital forensics to find where mobile apps store identity information. The free Dexcalibur Community Edition costs nothing and supports Android instrumentation generation and dynamic deobfuscation.