How to set up and use Mobile Security Framework (MobSF)

How to Set Up and Use MobSF

Mobile Security Framework (MobSF) is an open-source tool for analysing the security of mobile apps. This guide shows how to install it and read the results of an APK analysis. Only analyse apps you own or are authorised to test.

Note: the screenshots below come from an older MobSF release, which ran on Python 2.7 with Oracle JDK 1.7 or later. Current releases need Python 3 and are easiest to run with Docker. Check the official MobSF repository for up-to-date installation steps; the analysis screens work the same way.

Install and start MobSF

Search for Mobile Security Framework and download it from the official repository.
Open the downloaded folder.
Open a command prompt in that folder.
Install the requirements: python -m pip install -r requirements.txt, then press Enter.
Wait for the installation to finish.
Start the server: python manage.py runserver PORT_NO, then press Enter.
Copy the address shown in the output.
Open a browser and paste the address.
The MobSF home page opens.

Analyse an APK

Get the APK file you want to analyse.
Save it to your computer.
In MobSF, click Upload & Analyze.
Select the APK file and click Open.
Wait while MobSF analyses the app; this can take a few minutes.

Read the results

Information: a summary of the app, including the number of activities, services, receivers and providers.

Scan options: view the decompiled Java and Smali code.

Signer certificate: details of the certificate used to sign the APK.

Permissions: every permission the app requests, with a severity rating for each.

Binary analysis: security properties of the compiled libraries.

Android API: the Android APIs the app uses, such as WebView requests.

Browsable activities: activities that can be opened from a link.

Security analysis

Manifest analysis:

Code analysis:

File analysis:

Malware analysis

Dex malware analysis:

Domain malware check:

Reconnaissance

URLs found in the app:

Email addresses:

Strings:

Components

Activities:

Services:

Receivers:

Providers:

Libraries:

Files:

How Vooki Pro helps

MobSF analyses the app itself; Vooki Pro tests the web APIs it talks to.
Import the app's API requests into the API Builder and scan them for injection, authorization flaws and data exposure.
Together they cover both the mobile client and its back end.

Frequently asked questions

What does MobSF do?

It performs static and dynamic analysis of Android and iOS apps to find insecure code, permissions and storage.

Does MobSF test back-end APIs?

Not in depth. Use an API security scanner for the server side.

Try Vooki Pro free for 7 days

Pair your mobile analysis with API security testing. The trial unlocks every feature for 7 days, and scanning runs on your own machine.

Get Vooki Pro → · REST API scanning with Vooki Pro

How to Set Up and Use MobSF | Vooki Pro