MobSF (Mobile Security Framework)
Что такое MobSF (Mobile Security Framework)?
MobSF (Mobile Security Framework)An open-source mobile-app static and dynamic analysis platform supporting Android (APK/AAB), iOS (IPA), and Windows mobile binaries — widely used by AppSec teams as a first-pass scanner against OWASP MASVS/MASTG controls.
MobSF (Mobile Security Framework) is an open-source, Docker-deployable mobile-application security testing platform maintained by Ajin Abraham. It accepts Android APK/AAB, iOS IPA, and Windows mobile binaries and produces a comprehensive HTML/JSON report covering manifest analysis, permission risk, hard-coded secrets, insecure crypto and network calls, SSL pinning indicators, OWASP MASVS/MASTG control mapping, file-level entropy, and dependency analysis. A dynamic-analysis mode runs the APK on an attached Android emulator or device with Frida instrumentation, capturing API calls, file IO, network traffic (including TLS-pinned), keystore usage, and screenshots, and supports scripted exploitation via the integrated Objection. MobSF is commonly used as the first-pass scanner in mobile AppSec pipelines, with deeper manual review and pen-testing layered on top of its findings, and is referenced in many enterprise mobile-AppSec workflows and bug-bounty methodologies. Reports map to OWASP MASVS sections, which makes the output easy to roll up into a MASVS-aligned mobile risk score.
● Примеры
- 01
A CI/CD pipeline runs MobSF in static-only mode on every Android release build and fails the build if MASVS L1 hard-coded-secret controls are violated.
- 02
An AppSec engineer uses MobSF's dynamic analysis mode to confirm that a banking iOS app fails to enforce TLS pinning when run against a re-signed binary.
● Частые вопросы
Что такое MobSF (Mobile Security Framework)?
An open-source mobile-app static and dynamic analysis platform supporting Android (APK/AAB), iOS (IPA), and Windows mobile binaries — widely used by AppSec teams as a first-pass scanner against OWASP MASVS/MASTG controls. Относится к категории Мобильная безопасность в кибербезопасности.
Что означает MobSF (Mobile Security Framework)?
An open-source mobile-app static and dynamic analysis platform supporting Android (APK/AAB), iOS (IPA), and Windows mobile binaries — widely used by AppSec teams as a first-pass scanner against OWASP MASVS/MASTG controls.
Как работает MobSF (Mobile Security Framework)?
MobSF (Mobile Security Framework) is an open-source, Docker-deployable mobile-application security testing platform maintained by Ajin Abraham. It accepts Android APK/AAB, iOS IPA, and Windows mobile binaries and produces a comprehensive HTML/JSON report covering manifest analysis, permission risk, hard-coded secrets, insecure crypto and network calls, SSL pinning indicators, OWASP MASVS/MASTG control mapping, file-level entropy, and dependency analysis. A dynamic-analysis mode runs the APK on an attached Android emulator or device with Frida instrumentation, capturing API calls, file IO, network traffic (including TLS-pinned), keystore usage, and screenshots, and supports scripted exploitation via the integrated Objection. MobSF is commonly used as the first-pass scanner in mobile AppSec pipelines, with deeper manual review and pen-testing layered on top of its findings, and is referenced in many enterprise mobile-AppSec workflows and bug-bounty methodologies. Reports map to OWASP MASVS sections, which makes the output easy to roll up into a MASVS-aligned mobile risk score.
Как защититься от MobSF (Mobile Security Framework)?
Защита от MobSF (Mobile Security Framework) обычно сочетает технические меры и операционные практики, как описано в определении выше.
Какие есть другие названия MobSF (Mobile Security Framework)?
Распространённые альтернативные названия: Mobile Security Framework, MobSF scanner.
● Связанные термины
- mobile-security№ 772
Безопасность мобильных приложений
Практика проектирования, разработки и тестирования iOS- и Android-приложений для защиты данных пользователя, предотвращения реверс-инжиниринга и противодействия модификации во время выполнения.
- compliance№ 871
OWASP MASVS
OWASP Mobile Application Security Verification Standard — базовый набор проверяемых требований безопасности для мобильных приложений iOS и Android.
- compliance№ 872
OWASP Mobile Top 10
Образовательный документ OWASP, ранжирующий наиболее критичные риски безопасности мобильных приложений для iOS, Android и подобных платформ.
- mobile-security№ 481
Frida Dynamic Instrumentation
An open-source dynamic instrumentation toolkit by Ole André Vadla Ravnås that lets researchers hook, trace, and rewrite functions inside running processes on Android, iOS, Windows, macOS, and Linux — the de facto tool for mobile app reverse engineering and bypass research.
- appsec№ 1081
SAST (Static Application Security Testing)
Автоматический анализ исходного кода, байт-кода или бинарных файлов без их выполнения для поиска уязвимостей вроде инъекций, небезопасных API или слабой криптографии.
- appsec№ 302
DAST (Dynamic Application Security Testing)
Black-box тестирование безопасности работающего приложения по сети для поиска уязвимостей, проявляющихся только в рантайме: инъекций, ошибок аутентификации и неправильных конфигураций.