mobsfscan

mobsfscan mobsfscan 是一款静态分析工具，可在你的 Android 和 iOS 源代码中查找不安全的代码模式。支持 Java、Kotlin、Android XML、iOS Info.plist、Swift 和 Objective C 代码。mobsfscan 使用 MobSF 静态分析规则，并由 semgrep 和 libsast 模式匹配器提供支持。 在印度用 制作 支持 mobsfscan 如果你喜欢 mobsfscan 并觉得它有用，请考虑捐赠。 在线学习课程与认证 使用 MobSF 进行自动化移动应用安全评估 -MAS Android 安全工具专家 -ATX 安...

Mobile-Security-Framework-MobSF

Mobile Security Framework MobSF 移动安全框架（MobSF）是一个针对 Android、iOS 和 Windows Mobile 移动应用的安全研究平台。MobSF 可用于多种场景，如移动应用安全、渗透测试、恶意软件分析和隐私分析。静态分析器支持常见的移动应用二进制文件，如 APK、IPA、APPX 和源代码。同时，动态分析器支持 Android 和 iOS 应用，并提供了一个交互式检测测试、运行时数据和网络流量分析的平台。MobSF 通过 REST API 和 CLI 工具与您的 DevSecOps 或 CI/CD 流水线无缝集成，轻松增强您的安全工作流程...

android_application_analyzer

Android应用分析器 该工具用于分析本地存储中Android应用的内容。 使用以下命令安装依赖项： chmod +x setup.sh ./setup.sh 使用以下命令通过python3运行该工具： python -m venv androidapplicationanalyzer androidapplicationanalyzer\Scripts\activate pip install -r requirements.txt python main.py 注意 为了运行"Fridump"和"Frida universal ssl...

Open Redirect in Login Redirect - MobSF

Mobile Security Framework MobSF is a security research platform for mobile applications in Android, iOS and Windows Mobile. An open redirect vulnerability exist in MobSF authentication view. id: CVE-2024-41955 info: name: Open Redirect in Login Redirect - MobSF author: Farish severity: medium...

MobSF - Path Traversal

MobSF is vulnerable to an issue with apktool CVE-2024-21633 that allows for RCE or arbitrary file writing. It does this through a path traversal vulnerability. This template tests for it by writing to a local file and reading that file. RCE can be achieved by overwriting jadx, as shown in the two...

CVE-2024-21633

MobSF 远程代码执行（通过 CVE-2024-21633） 我在 apktool 中发现了一个任意文件写入漏洞，并通过 GitHub 安全公告 报告了该漏洞。我知道许多项目都依赖或依赖于 apktool，但在安全公告发布和修复之后，似乎很少有人注意到或关心它。我决定在一些大型依赖项目中检查其影响和可利用性，于是首先从 MobSF 开始。 该漏洞允许我们在相对于“$decode target path/res/”的路径上写入任何内容，最大的影响是获得 RCE。但有一个问题：写入的文件不能被直接执行。 在深入之前，我有两个想法： 我们可以尝试覆盖 shell 初始化文件，如...

MobSF_AI

MobSF AI Sidecar 该项目为 Mobile Security Framework MobSF 添加了一个由 AI 驱动的聊天助手。它允许安全分析师在界面内直接询问关于 MobSF 生成的分析报告的问题，并利用 OpenAI 的模型。 功能 无缝集成 ：通过 Nginx 反向代理将专用聊天界面直接注入 MobSF 报告中。 上下文感知 ：AI 助手自动获取当前分析报告（静态分析），并以此作为上下文回答您的问题。 交互式问答 ：询问与您的应用相关的漏洞、代码片段、修复步骤或通用安全概念。 架构与工作原理 该解决方案由三个协同工作的 Docker 服务组成： 1. MobSF...

Mobile-Security-Framework-MobSF v4.5.3

Mobile Security Framework MobSF Mobile Security Framework MobSF is a security research platform for mobile applications in Android, iOS and Windows Mobile. MobSF can be used for a variety of use cases such as mobile application security, penetration testing, malware analysis, and privacy analysis...

MobSF Vulnerable to Arbitrary File Read via Path Traversal in ZIP Uploads

SummaryThe findiconpathzip function in MobSF does not properly sanitize the android:icon attribute extracted from an Android manifest before resolving it as a filesystem path.An attacker can supply a malicious android:icon value containing path traversal sequences, causing MobSF to read arbitrary...

MobSF Vulnerable to Zip Bomb Denial of Service via Per-File Size Limit Bypass in ZIP/APK Extraction

SummaryWhen extracting uploaded ZIP/APK files, MobSF checks if individual files exceed ZIPMAXUNCOMPRESSEDFILESIZE 400 MB and logs "Skipping" — but the code lacks a continue statement, so extraction proceeds anyway. The log message is misleading; the file is still written to disk. Verified Impact...

PYSEC-2026-3691 MobSF Vulnerable to Zip Bomb Denial of Service via Per-File Size Limit Bypass in ZIP/APK Extraction

Summary When extracting uploaded ZIP/APK files, MobSF checks if individual files exceed ZIPMAXUNCOMPRESSEDFILESIZE 400 MB and logs "Skipping" — but the code lacks a continue statement, so extraction proceeds anyway. The log message is misleading; the file is still written to disk. Verified Impact...

MobSF's CSRF checks not enforced after Django migration

SummaryDjango's CsrfViewMiddleware exists only in the deprecated MIDDLEWARECLASSES ignored since Django 2.0. The active MIDDLEWARE tuple does not include it. All authenticated web POST endpoints delete scan, upload, download APK, change password, manage users accept requests without CSRF tokens...

PYSEC-2026-3688 MobSF's CSRF checks not enforced after Django migration

Summary Django's CsrfViewMiddleware exists only in the deprecated MIDDLEWARECLASSES ignored since Django 2.0. The active MIDDLEWARE tuple does not include it. All authenticated web POST endpoints delete scan, upload, download APK, change password, manage users accept requests without CSRF tokens...

PYSEC-2026-3690 MobSF has SSRF port restriction bypass in assetlinks_check

Summary MobSF's Android App Link assetlinks checker validates only the manifest android:host value with validhost, but then appends the separate android:port value into the URL used for the server-side request. This bypasses the current port restriction in validhost and lets a crafted APK cause...

PYSEC-2026-3689 MobSF Vulnerable to Arbitrary File Read via Path Traversal in ZIP Uploads

Summary The findiconpathzip function in MobSF does not properly sanitize the android:icon attribute extracted from an Android manifest before resolving it as a filesystem path. An attacker can supply a malicious android:icon value containing path traversal sequences, causing MobSF to read arbitra...

MobSF has SSRF port restriction bypass in assetlinks_check

SummaryMobSF's Android App Link assetlinks checker validates only the manifest android:host value with validhost, but then appends the separate android:port value into the URL used for the server-side request. This bypasses the current port restriction in validhost and lets a crafted APK cause...

CVE-2026-68924

creationtimestamp| type| source ---|---|--- 2026-08-18 20:35:08+00:00| published-proof-of-concept| https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-x768-8642-mmq9...

CVE-2026-68922

creationtimestamp| type| source ---|---|--- 2026-08-18 20:35:06+00:00| published-proof-of-concept| https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-8j49-mmcx-4mp5...

CVE-2026-68923

MobSF is a mobile application security testing tool used. Prior to 4.5.1, mobsf/MobSF/settings.py places django.middleware.csrf.CsrfViewMiddleware only in the deprecated MIDDLEWARECLASSES setting and omits it from the active MIDDLEWARE tuple, allowing a remote attacker to make a logged-in victim...

CVE-2026-68924

MobSF is a mobile application security testing tool used. Prior to 4.5.1, the unzip function in mobsf/StaticAnalyzer/views/common/sharedfunc.py logs that an archive member exceeding ZIPMAXUNCOMPRESSEDFILESIZE is being skipped but does not continue to the next member, so an authenticated user can...