MobSF

With MobSF (Mobile Security Framework), you upload a mobile app file in your browser and get a list of places that may cause problems. This review covers only one use: checking apps that you built yourself.

This review is for people who build Android or iOS apps and want to check them for security issues before release. After reading it, you can do the following:

• Start MobSF with Docker
• Run static analysis on your own APK or similar file and read the results
• Decide what you need for dynamic analysis

##What MobSF is for

MobSF is a security assessment tool for Android, iOS, and Windows apps. It analyzes apps in two ways.

MobSF also has REST APIs and CLI tools, so you can add automatic checks to a CI/CD pipeline.

##Try it safely with static analysis of your own app

Start with static analysis only. All you need is Docker. The official docs recommend Docker 20.10.0 or later.

1. Following the official docs, pull the latest image and start it.

   docker pull opensecurity/mobile-security-framework-mobsf:latest
   docker run -it --rm -p 8000:8000 opensecurity/mobile-security-framework-mobsf:latest

2. Open http://127.0.0.1:8000 in your browser.

3. Log in with the default username and password (both are mobsf).

4. Upload an APK or other file that you built. When the analysis finishes, the results page appears.

5. Review the findings about permissions and settings, and check that they match what you intended.

This command uses --rm, so stopping MobSF removes the container and the analysis results stored in it. To keep results, follow the “Docker options” page of the official docs and mount a local folder to /home/mobsf/.MobSF in the container.

##What dynamic analysis needs

For dynamic analysis, start a supported Android virtual device or physical device before you start MobSF. The official docs list these main options:

Full rooted support covers Android up to 11 (API 30). The docs say newer versions and non-rooted devices use Frida Gadget mode (beta) from v4.6.0. This mode modifies and re-signs the app, so the app’s signature changes. At the time of writing, the latest GitHub release is v4.5.3. If you plan to use a physical device or Frida Gadget mode, check that your version supports it.

To run MobSF for dynamic analysis, pass the device identifier in MOBSF_ANALYZER_IDENTIFIER and also publish port 1337.

docker run -it --rm \
    -p 8000:8000 \
    -p 1337:1337 \
    -e MOBSF_ANALYZER_IDENTIFIER=<adb device identifier> \
    opensecurity/mobile-security-framework-mobsf:latest

On Linux, also add --add-host=host.docker.internal:host-gateway. The Dynamic Analyzer page of the official docs explains how to find the identifier for each environment.

##Cautions

##Read next

• cd ../ghidraGhidraa reverse engineering tool for reading compiled programs
• cd ../zapOWASP ZAPa tool that sits between the browser and a web app to check its traffic
• cat ~/guides/lab-setup.mdHow to set up a safe test lab