MobSF - BookJMP

Overview

MobSF (Mobile Security Framework) is an all-in-one automated framework for mobile app pentesting and malware analysis. Performs static and dynamic analysis, generates detailed security reports, and exposes a REST API for CI/CD integration. Supports: APK · IPA · APPX · source code zips Latest release: v4.4.6: github.com/MobSF/Mobile-Security-Framework-MobSF

Install: Docker (Recommended)

Fastest path. No dependency setup required.

docker pull opensecurity/mobile-security-framework-mobsf:latest
docker run -it --rm -p 8000:8000 opensecurity/mobile-security-framework-mobsf:latest

With persistent storage (keep scan history between runs):

docker run -it --rm \
  -p 8000:8000 \
  -v ~/mobsf-data:/home/mobsf/.MobSF \
  opensecurity/mobile-security-framework-mobsf:latest

Access: http://localhost:8000 Default credentials: mobsf / mobsf

Install: Local (Linux / macOS)

Requirements: Python 3.12+, Git, OpenSSL, wkhtmltopdf (for PDF reports)

# Dependencies (Debian/Ubuntu)
sudo apt install python3.12 python3.12-venv git openssl wkhtmltopdf

# Clone
git clone https://github.com/MobSF/Mobile-Security-Framework-MobSF.git
cd Mobile-Security-Framework-MobSF

# Setup
./setup.sh

# Run
./run.sh 127.0.0.1:8000

macOS (Homebrew):

brew install [email protected] wkhtmltopdf
./setup.sh
./run.sh 127.0.0.1:8000

Static Analysis

Upload via Web UI

Open http://localhost:8000
Drag and drop the APK (or IPA/APPX) into the upload zone
MobSF decompiles, analyzes, and presents a full report

Upload via REST API

# Get API key from http://localhost:8000/api_docs
API_KEY="your_api_key_here"

# Upload APK
curl -F "[email protected]" \
     -H "Authorization: $API_KEY" \
     http://localhost:8000/api/v1/upload

# Response contains a hash:
# {"hash": "abc123...", "file_name": "target.apk", "scan_type": "apk"}

HASH="abc123..."

# Trigger scan
curl -X POST \
     --url http://localhost:8000/api/v1/scan \
     --data "scan_type=apk&file_name=target.apk&hash=$HASH" \
     -H "Authorization: $API_KEY"

# Get JSON report
curl -X POST \
     --url http://localhost:8000/api/v1/report_json \
     --data "hash=$HASH" \
     -H "Authorization: $API_KEY" \
     -o report.json

# Download PDF report
curl -X POST \
     --url http://localhost:8000/api/v1/download_pdf \
     --data "hash=$HASH" \
     -H "Authorization: $API_KEY" \
     -o report.pdf

What the Static Report Covers

Section	What it Finds
Manifest Analysis	Exported components, dangerous flags, permissions
Code Analysis	Hardcoded secrets, insecure APIs, crypto issues
Binary Analysis	Compiler flags, NX/PIE, stack canaries
Network Security	Cleartext traffic, pinning config, domains
File Analysis	Embedded keys, certs, sensitive resource files
CVSS Scoring	Severity ratings per finding
OWASP Mapping	Each finding mapped to MASVS category

Dynamic Analysis: Android

Dynamic analysis requires a real device or emulator with root access.

Emulator Setup (Android-x86 / AVD)

Recommended: Genymotion or Android Studio AVD with a non-Google Play image (root accessible).

# Check MobSF detects the device
adb devices

Start Dynamic Analysis

Upload and scan the APK (static scan must run first)
Click “Start Dynamic Analysis” in the report
MobSF installs the app and its instrumentation agent on the device
Interact with the app through the emulator while MobSF captures:
- Network traffic (HTTP/HTTPS with SSL unpinning)
- Filesystem reads/writes
- Logcat output
- Screenshot timeline
- Exported activity/service invocations
Click “Stop Analysis” → MobSF generates a dynamic report

Dynamic Report Covers

Decrypted HTTPS traffic (via injected proxy)
Files created/modified during runtime
Sensitive data leaked to logs
Exported component interactions
Screenshot evidence

mobsfscan: CI/CD Integration

Static analysis scanner for source code, usable in pipelines without the full MobSF server.

pip install mobsfscan

# Scan source directory
mobsfscan ./android-source/

# JSON output for pipeline parsing
mobsfscan --json -o results.json ./android-source/

GitHub Actions example:

- name: MobSF Static Scan
  uses: MobSF/mobsfscan@main
  with:
    args: '. --json --output results.json'

Useful API Endpoints

Method	Endpoint	Description
`POST`	`/api/v1/upload`	Upload APK/IPA/APPX
`POST`	`/api/v1/scan`	Trigger scan on uploaded file
`POST`	`/api/v1/report_json`	Get full JSON report
`POST`	`/api/v1/download_pdf`	Download PDF report
`GET`	`/api/v1/scans`	List all previous scans
`POST`	`/api/v1/delete_scan`	Delete scan by hash
`POST`	`/api/v1/dynamic/get_apps`	List apps for dynamic analysis

Full API docs: http://localhost:8000/api_docs

Online Demo

No setup needed for quick static analysis: mobsf.live: upload and scan directly in browser.

​Overview

​Install: Docker (Recommended)

​Install: Local (Linux / macOS)

​Static Analysis

​Upload via Web UI

​Upload via REST API

​What the Static Report Covers

​Dynamic Analysis: Android

​Emulator Setup (Android-x86 / AVD)

​Start Dynamic Analysis

​Dynamic Report Covers

​mobsfscan: CI/CD Integration

​Useful API Endpoints

​Online Demo