mobsf/mobile-security-framework-mobsf

Mobile Security Framework, abbreviated MobSF, is an automated security testing tool for mobile apps on Android, iOS, and Windows Mobile. When companies build a mobile app they normally need to check it for security problems before shipping it, things like leaked secrets, dangerous permissions, insecure network calls, or actual malware behaviour. MobSF bundles a large amount of that checking into one self-hostable platform so a single person can run it instead of stitching together a dozen tools. There are two main parts. The Static Analyzer takes a compiled app file directly, such as an Android APK, an iOS IPA, or a Windows APPX, or it can take the source code, and inspects it without running it. The Dynamic Analyzer runs the Android or iOS app on an instrumented device and observes its real behaviour at runtime, including the network traffic it sends and the data it touches. On top of those analysers the README mentions REST APIs and command-line tools so MobSF can be plugged into a continuous-integration or DevSecOps pipeline; a companion project called mobsfscan is highlighted for the CI case. The quickest way to run it is the provided Docker image, which exposes a web interface on port 8000 with a default username and password of mobsf. People reach for MobSF when they are doing penetration testing on a mobile app, doing privacy review, analysing suspected malware, or wiring automatic mobile security scans into their build pipeline. It runs on macOS, Linux, and Windows, requires Python 3.12 or newer, is licensed under GPL-3.0, and is bundled into security distributions including Android Tamer, BlackArch, and Pentoo. The full README is longer than what was provided.