Thorfinn
Open-source automated DAST framework for Android apps from PhonePe. Drop in an APK (or target a package on a connected device/emulator): Thorfinn decompiles with JADX/APKTool, traces Android-specific taint flows (intents, deep links, WebViews, Content Providers) with Tai-e plus Semgrep, TruffleHog, and Manifest checks, then uses LLMs (OpenAI, Anthropic, Gemini, or GitHub Copilot CLI) to triage findings, generate adb PoCs, and validate exploitability on-device. HTML/JSON reports include source-to-sink paths and runtime evidence. Apache-2.0.
Quick Info
Primary Category
securitySecondary Categories
Programming Languages
Supported Platforms
Official Website
Visit ThorfinnKey Features
Pros
- Goes beyond static pattern hits by validating exploitability on a real device
- Strong Android client-side vulnerability coverage (intents, WebViews, providers)
- Free Apache-2.0 open source from PhonePe AppSec
- Flexible LLM providers and diff-based rescan for token efficiency
- Actionable reports with PoCs and runtime evidence
Cons
- Steep setup (toolchain + LLM keys + device)
- Android APK focus only
- LLM costs and quality affect triage/PoC accuracy
- Newer project vs mature commercial mobile AppSec suites
Limitations
- Android-only — not a web, iOS, or general network DAST scanner
- Requires Java 17, Maven, ADB, connected device/emulator, and LLM API access for full triage/PoC flow
- Large APKs may need heap/time limits; whole-program analysis can be heavy
- LLM-generated adb commands should be reviewed; auto-approve is unsafe on untrusted targets
- Authorized testing only — not for unauthorized app assessment
What Can You Do With Thorfinn?
Real-world use cases and scenarios where Thorfinn excels
Quality Assurance Automation
Reduce manual testing time and improve software quality by automating repetitive test cases with Thorfinn.
Getting Started with Thorfinn
Follow these steps to start testing with Thorfinn
Sign Up for Thorfinn
Visit the official Thorfinn website and create your account. Most tools offer a free trial or free tier to get started.
Install & Configure
Install Thorfinn using your preferred programming language (Java, Kotlin) and configure your testing environment.
Write Your First Test
Start with a simple test case to familiarize yourself with Thorfinn's syntax and capabilities. Use their documentation and examples as reference.
Integrate with CI/CD
Once comfortable, integrate Thorfinn into your continuous integration pipeline to automate test execution on every code change.
Scale & Optimize
Expand your test coverage, optimize test execution time, and establish best practices for your team's testing workflow.
Pricing & Plans
FREEFree
Thorfinn is completely free to use with no licensing costs. Perfect for individuals, small teams, and organizations with budget constraints.
💡 Recommendation: Great for getting started without financial commitment.
Frequently Asked Questions About Thorfinn
Alternative Security Testing Tools
Compare Thorfinn with other popular security testing tools
Parasoft C/C++test
AI-powered static code analysis and unit testing solution for C/C++ development. Ensures compliance with safety and security standards like MISRA, CERT, AUTOSAR C++14, ISO 26262, and DO-178C with automated vulnerability detection and ML-based violation prioritization.
ZAP (Zed Attack Proxy)
The world's most widely used web app scanner. Free and open source DAST tool by Checkmarx. A community based GitHub Top 1000 project that anyone can contribute to.
Final Verdict
Thorfinn is a focused testing tool. The fact that it's completely free makes it an excellent choice for teams of any size. The steeper learning curve is offset by its advanced capabilities for complex testing scenarios.
✅ Best For:
- • Goes beyond static pattern hits by validating exploitability on a real device
- • Strong Android client-side vulnerability coverage (intents, WebViews, providers)
- • Free Apache-2.0 open source from PhonePe AppSec
⚠️ Consider If:
- • Steep setup (toolchain + LLM keys + device)
- • Android APK focus only
- • LLM costs and quality affect triage/PoC accuracy
Reviews
No reviews yet. Be the first to review this tool!