# MobSF: static analysis of mobile applications

> How to run MobSF against an APK or IPA, what its static analysis reports, and where mobile recon fits in Tandera.

`MobSF` decompiles a mobile application and reports what it finds: hardcoded secrets, insecure configuration, dangerous permissions, exported components, network security settings, and the endpoints the app talks to. Static analysis only, in this usage — no device required.

## Install

Docker is the sane path; the native install has a long dependency chain.

```bash
docker run -it --rm -p 8000:8000 opensecurity/mobile-security-framework-mobsf:latest
```

Then open `http://localhost:8000` and upload the binary, or drive it over the API.

## Core commands

```bash
# upload
curl -F 'file=@app.apk' http://localhost:8000/api/v1/upload \
  -H "Authorization: $MOBSF_KEY"

# scan
curl -X POST http://localhost:8000/api/v1/scan \
  -H "Authorization: $MOBSF_KEY" \
  -d "scan_type=apk&file_name=app.apk&hash=<hash>"

# JSON report
curl -X POST http://localhost:8000/api/v1/report_json \
  -H "Authorization: $MOBSF_KEY" -d "hash=<hash>"
```

The API key is printed to the container log on startup.

## Output

A large JSON document: `permissions`, `certificate_analysis`, `manifest_analysis`, `code_analysis`, `secrets`, `urls`, `domains`, `firebase_urls`, plus a computed security score.

## Where it sits in Tandera

MobSF is the whole of `recon_mobile` — the only tool that flow schedules, running in the **static** phase against an iOS or Android application seed. The flow's risk ceiling is `Static`: nothing is sent to any target, the analysis is entirely of the binary you supply.

The `urls` and `domains` MobSF extracts are the bridge to the rest of the platform — API hosts recovered from a mobile bundle become in-scope targets for the web and API flows.

## Using it in a pentest

**The endpoint list is the most valuable output.** Mobile apps talk to APIs that have no public documentation and often weaker authorisation than the web front end. `urls` and `domains` from a MobSF report are a map of that surface.

**Hardcoded secrets in a mobile binary are always shipped.** Unlike a server-side config leak, every user already has this file. Treat a verified key in an APK as disclosed, not as at risk of disclosure.

**Static analysis over-reports.** The security score and much of `code_analysis` is pattern matching. Verify anything you intend to report by reading the decompiled code around it.

**Check `network_security_config`.** Cleartext traffic permitted, or a custom trust anchor, is a real finding and easy to miss in the volume of output.

---

Canonical: https://tandera.io/tools/mobsf
This page as markdown: https://tandera.io/tools/mobsf.md
Index for agents: https://tandera.io/llms.txt

Every page here is also available as markdown: append `.md` to the path (e.g. `/recon.md`, `/index.md` for this homepage, `/blog/<slug>.md`), or request the canonical path with `Accept: text/markdown`.