MobSF: static analysis of mobile applications

MobSF · GPL-3.0

MobSF decompiles a mobile application and reports what it finds: hardcoded secrets, insecure configuration, dangerous permissions, exported components, network security settings, and the endpoints the app talks to. Static analysis only, in this usage — no device required.

Install

Docker is the sane path; the native install has a long dependency chain.

docker run -it --rm -p 8000:8000 opensecurity/mobile-security-framework-mobsf:latest

Then open http://localhost:8000 and upload the binary, or drive it over the API.

Core commands

# upload
curl -F 'file=@app.apk' http://localhost:8000/api/v1/upload 
  -H "Authorization: $MOBSF_KEY"

# scan
curl -X POST http://localhost:8000/api/v1/scan 
  -H "Authorization: $MOBSF_KEY" 
  -d "scan_type=apk&file_name=app.apk&hash=<hash>"

# JSON report
curl -X POST http://localhost:8000/api/v1/report_json 
  -H "Authorization: $MOBSF_KEY" -d "hash=<hash>"

The API key is printed to the container log on startup.

Output

A large JSON document: permissions, certificate_analysis, manifest_analysis, code_analysis, secrets, urls, domains, firebase_urls, plus a computed security score.

Where it sits in Tandera

MobSF is the whole of recon_mobile — the only tool that flow schedules, running in the static phase against an iOS or Android application seed. The flow’s risk ceiling is Static: nothing is sent to any target, the analysis is entirely of the binary you supply.

The urls and domains MobSF extracts are the bridge to the rest of the platform — API hosts recovered from a mobile bundle become in-scope targets for the web and API flows.

Using it in a pentest

The endpoint list is the most valuable output. Mobile apps talk to APIs that have no public documentation and often weaker authorisation than the web front end. urls and domains from a MobSF report are a map of that surface.

Hardcoded secrets in a mobile binary are always shipped. Unlike a server-side config leak, every user already has this file. Treat a verified key in an APK as disclosed, not as at risk of disclosure.

Static analysis over-reports. The security score and much of code_analysis is pattern matching. Verify anything you intend to report by reading the decompiled code around it.

Check network_security_config. Cleartext traffic permitted, or a custom trust anchor, is a real finding and easy to miss in the volume of output.