in India
| 
| 
| 
What is this?
MobSF is an automated, all-in-one mobile security framework: it performs static and dynamic analysis, penetration testing, malware analysis and privacy analysis on Android, iOS and Windows Mobile apps.
MobSF is an automated, all-in-one mobile security framework: it performs static and dynamic analysis, penetration testing, malware analysis and privacy analysis on Android, iOS and Windows Mobile apps.Is it a library I add to my own code, or a tool I run?It's a tool you run — a self-hosted security platform with a web interface where you submit an app and get a full assessment report.
It's a tool you run — a self-hosted security platform with a web interface where you submit an app and get a full assessment report.How do I get it running?The README points to a quick Docker setup, and there's a hosted demo at mobsf.live if you want to try the static analyzer before installing anything.
The README points to a quick Docker setup, and there's a hosted demo at mobsf.live if you want to try the static analyzer before installing anything.Does dynamic analysis work for every platform MobSF supports?No — the dynamic analyzer supports Android and iOS applications only; Windows Mobile apps (APPX) are limited to static analysis.
No — the dynamic analyzer supports Android and iOS applications only; Windows Mobile apps (APPX) are limited to static analysis.What can it actually analyze?The static analyzer accepts Android APK, iOS IPA and Windows APPX binaries as well as plain source code; the dynamic analyzer runs apps in instrumented sessions, capturing runtime data and network traffic.
The static analyzer accepts Android APK, iOS IPA and Windows APPX binaries as well as plain source code; the dynamic analyzer runs apps in instrumented sessions, capturing runtime data and network traffic.Can I automate it inside a CI/CD pipeline?Yes — MobSF exposes REST APIs and CLI tools built for DevSecOps integration, and the companion project mobsfscan is designed specifically for running MobSF checks in CI/CD.
Yes — MobSF exposes REST APIs and CLI tools built for DevSecOps integration, and the companion project mobsfscan is designed specifically for running MobSF checks in CI/CD.Do I always have to install it myself?No — besides Docker, MobSF comes bundled with the Android Tamer, BlackArch and Pentoo security distributions, so users of those distros get it out of the box.
No — besides Docker, MobSF comes bundled with the Android Tamer, BlackArch and Pentoo security distributions, so users of those distros get it out of the box.Does MobSF cost anything?It's free and open source under GPL-3.0. The project accepts donations and offers paid enterprise support (priority features, live support, onsite training), but the framework itself costs nothing.
It's free and open source under GPL-3.0. The project accepts donations and offers paid enterprise support (priority features, live support, onsite training), but the framework itself costs nothing.Which topics is it in?dynamic-analysis, api-testing, mobile-security, owasp, web-security, rest, malware-analysis, apk, devsecops, vulnerability-scanner, ci-cd, pentesting
dynamic-analysis, api-testing, mobile-security, owasp, web-security, rest, malware-analysis, apk, devsecops, vulnerability-scanner, ci-cd, pentesting