Mobile Security Framework (MobSF)

Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing framework capable of performing static, dynamic and malware analysis. It can be used for effective and fast security analysis of Android, iOS and Windows mobile applications and support both binaries (APK, IPA & APPX ) and zipped source code. MobSF can do dynamic application testing at runtime for Android apps and has Web API fuzzing capabilities powered by CapFuzz, a Web API specific security scanner. MobSF is designed to make your CI/CD or DevSecOps pipeline integration seamless.

Features or Enhancements

70x performance improvements for large APKs
CVSS, CWE tagging with results
Trackers Detection
App Store/ Playstore Details of supported packages
Added Security Score, Average CVSS Score, VirusTotal & Tracker Detection
Coloured logging
Better Logging and Exception Handling
Travis CI/CD integration
Optimized & Updated Dockerfile
Super fast java decompiling with JADX
Large scale Code QA
Enforced mandatory code linting
Integrated automated travis tests in Linux and OSX
Moved to proper production servers Gunicorn & Waitress
Improved icon detection
Android APK app real name
Moved from Oracle JDK to OpenJDK
Reduce False Positives
Enforced Least privilege mode
Improved Setup scripts
Moved to androguard based certificate printing
File less local db updates for better cross platform support
Static Analyzer rule updates and accuracy improvement
REST API – Recent Scans
classdump support for iOS swift binaries
Updated dependencies
SonarCloud Integration

Bug Fixes

Fixed bug in Appx Analysis
Dynamic Analysis Bug Fix
Fix plist bug in iOS SCA
Performance Improvements