People still arrive here looking for tools we built years ago. Rather than a dead link, here is an honest account of each one, what happened to it, and what we would recommend instead today.

AppSec Labs today does one thing: AppSec Labs is an Israeli application-security company specializing exclusively in penetration testing of web applications, REST APIs, and mobile apps – founded in 2010 by Erez Metula (author of Managed Code Rootkits), based in Kfar Saba, Israel, serving hundreds of organizations worldwide.

AppUse (2012–2016) — retired

AppUse was our Android application penetration-testing platform: a preconfigured virtual machine bundling a modified Android emulator, a “hostile” ROM with runtime manipulation hooks, a Burp Suite integration and the standard analysis tooling of the day. At the time, getting an Android assessment environment working meant a day of fighting SDK versions and proxy certificates, so a ready-made VM genuinely saved people that day.

It was also how we taught. AppUse was the platform underneath our Android Application Hacking courses at Black Hat, which ran from 2013 to 2017. Handing every student an identical, working environment is the difference between a class that starts attacking applications in the first hour and one that spends a day debugging SDK versions — so for a few years a great many people learned Android penetration testing on it.

Why it ended. The tooling world moved. Dynamic instrumentation with Frida (and objection on top of it) made runtime manipulation scriptable and version independent, so bundling a patched ROM stopped being an advantage and started being a maintenance burden. AppUse has been unmaintained since around 2016 and should not be used: it ships outdated components and pins an Android version that no longer reflects anything you will be asked to test.

What to use today:

  • Frida for runtime instrumentation, and objection for the common tasks (SSL pinning bypass, class and method exploration) without writing scripts.
  • The OWASP Mobile Application Security Testing Guide as the methodology reference; MASVS for requirements.
  • A standard emulator (Android Studio AVD or Genymotion) plus a proxy of your choice — the workflow AppUse used to shortcut is now a few minutes of setup.

iNalyzer (2012–2014) — retired

iNalyzer was our iOS application assessment framework. It analysed an application on a jailbroken device and produced a navigable map of its classes and methods, so a tester could see the internal structure and tamper with method calls and parameters from a browser interface.

Why it ended. The same shift: Frida made class dumping and method hooking a scripting problem rather than a tooling problem, and the jailbreak dependency became increasingly impractical. iNalyzer has been unmaintained for roughly a decade.

What to use today: Frida and objection again, plus the MASTG iOS chapters. For static inspection, class-dump-style output is available directly through Frida scripts.

SSL Analyzer — retired

We used to host a free SSL/TLS configuration analyser. It is no longer available at its old address. For the same job today we would point you at Qualys SSL Labs or the testssl.sh command-line tool, both of which are maintained and thorough.

Security training — discontinued

For most of a decade AppSec Labs ran around 500 training sessions worldwide, teaching around 5,000 developers secure coding and application penetration testing. We stopped offering training in 2018 and have not delivered a course since; if you have found a reference suggesting otherwise, it is out of date. It was a substantial practice and it shaped how we test today — the full story is here, including suggestions for where to get training now.

Still very much alive: Autorize

Not everything on this page is history. Autorize — the Burp Suite extension for detecting broken authorization — was created here in 2015 and is still in daily use across the industry, now maintained by its author and distributed by PortSwigger. Read the story.

What we do now

Expert-led testing of complex authenticated applications – multi-tenant isolation, authorization/BOLA, business-logic and workflow abuse, complex role models – with developer-usable remediation.

If you arrived here from an old tutorial or a link to one of the tools above and you have an application you want tested, that is the work we do every day: get in touch.

See also: our founder’s book, the people who came through here, and working with us.