Mobile Security Framework
Mobile Security Framework (MobSF) is an intelligent, all-in-one open source
mobile application (Android/iOS). an automated pen-testing framework
capable of performing static and dynamic analysis. We've been depending
on multiple tools to carry out reversing, decoding, debugging, code
review, and pen-test and this process requires a lot of effort and time.
Mobile Security Framework can be used for effective and fast security
analysis of Android and iOS Applications. It supports binaries (APK & IPA) and zipped source code.
The static analyzer is able to perform automated code review, detect
insecure permissions and configurations, and detect insecure code like
ssl overriding, ssl bypass, weak crypto, obfuscated codes, improper
permissions, hardcoded secrets, improper usage of dangerous APIs,
leakage of sensitive/PII information, and insecure file storage. The
dynamic analyzer runs the application in a VM or on a configured device
and detects the issues at run time. Further analysis is done on the
captured network packets, decrypted HTTPS traffic, application dumps,
logs, error or crash reports, debug information, stack trace, and on the
application assets like setting files, preferences, and databases. This
framework is highly scalable that you can add your custom rules with
ease. A quick and clean report can be generated at the end of the tests.
We will be extending this framework to support other mobile platforms
like Tizen, WindowsPhone etc. in future.
Download
- Download latest release of MobSF: https://github.com/ajinabraham/Mobile-Security-Framework-MobSF/releases
- Download MobSF VM 0.1 ova file: https://goo.gl/PmLt78 (Download only if you need Dynamic Analysis)
Installation
Tested on Windows 7, 8, 8.1, 10, Ubuntu, OSX Mavericks
- Windows: Extract the MobSF compressed file to C:\MobSF
- Mac: Extract MobSF compressed file to /Users/MobSF
- Linux: Extract MobSF compressed file to /home/MobSF
No comments