Package: mobsfscan
mobsfscanmobsfscanis a static analysis tool that can find insecure code patterns in your Android and iOS source code. Supports Java, Kotlin, Android XML, Swift and Objective C Code. mobsfscan usesMobSFstatic analysis rules and is powered bysemgrepandlibsastpattern matcher.Made within IndiaSupport mobsfscanIf you liked mobsfscan and find it useful, please consider donating.e-Learning Courses & CertificationsAutomated Mobile Application Security Assessment with MobSF -MASAndroid Security Tools Expert -ATXInstallationpip install mobsfscanRequires Python 3.7+Command Line Options$mobsfscan
usage:mobsfscan[-h][--json][--sarif][--sonarqube][--html][--type{android,ios,auto}][-oOUTPUT][-cCONFIG][-w][--no-fail][-v][path...]positionalarguments:pathPathcanbefile(s)ordirectorieswithsourcecode

optionalarguments:-h,--helpshowthishelpmessageandexit--jsonsetoutputformatasJSON--sarifsetoutputformatasSARIF2.1.0--sonarqubesetoutputformatcompatiblewithSonarQube--htmlsetoutputformatasHTML--type{android,ios,auto}optional:forceandroidoriosrulesexplicitly-oOUTPUT,--outputOUTPUToutputfilenametosavetheresult-cCONFIG,--configCONFIGlocationto.mobsfconfigfile-w,--exit-warningnonzeroexitcodeonwarning--no-failforcezeroexitcode,takesprecedenceover--exit-warning-v,--versionshowmobsfscanversionExample Usage$mobsfscantests/assets/src/
-PatternMatch████████████████████████████████████████████████████████████3-SemanticGrep██████37mobsfscan:v0.3.0|AjinAbraham|opensecurity.in
╒══════════════╤════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╕
│RULEID│android_webview_ignore_ssl│
├──────────────┼────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│DESCRIPTION│InsecureWebViewImplementation.WebViewignoresSSLCertificateerrorsandacceptanySSLCertificate.ThisapplicationisvulnerabletoMITMattacks│
├──────────────┼────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│TYPE│RegexAnd│
├──────────────┼────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│PATTERN│['onReceivedSslError\\(WebView','\\.proceed\\(\\);']│
├──────────────┼────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│SEVERITY│ERROR│
├──────────────┼────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│INPUTCASE│exact│
├──────────────┼────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│CVSS│7.4│
├──────────────┼────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│CWE│CWE-295ImproperCertificateValidation│
├──────────────┼────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│OWASP-MOBILE│M3:InsecureCommunication│
├──────────────┼────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│MASVS│MSTG-NETWORK-3│
├──────────────┼────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│REF│https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05g-Testing-Network-Communication.md#webview-server-certificate-verification│
├──────────────┼────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│FILES│╒════════════════╤═════════════════════════════════════════════════════════════════════════════════════════════╕│
│││File│../test_files/android_src/app/src/main/java/opensecurity/webviewignoressl/MainActivity.java││
││├────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────┤│
│││MatchPosition│1480-1491││
││├────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────┤│
│││LineNumber(s)│50││
││├────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────┤│
│││MatchString│.proceed();││
││├────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────┤│
│││File│../test_files/android_src/app/src/main/java/opensecurity/webviewignoressl/MainActivity.java││
││├────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────┤│
│││MatchPosition│1331-1357││
││├────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────┤│
│││LineNumber(s)│46││
││├────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────┤│
│││MatchString│onReceivedSslError(WebView││
││╘════════════════╧═════════════════════════════════════════════════════════════════════════════════════════════╛│
╘══════════════╧════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╛Python API>>>frommobsfscan.mobsfscanimportMobSFScan>>>src='tests/assets/src/java/java_vuln.java'>>>scanner=MobSFScan([src],json=True)>>>scanner.scan(){'results':{'android_logging':{'files':[{'file_path':'tests/assets/src/java/java_vuln.java','match_position':(13,73),'match_lines':(19,19),'match_string':'            Log.d("htbridge", "getAllRecords(): " + records.toString());'}],'metadata':{'cwe':'CWE-532 Insertion of Sensitive Information into Log File','owasp-mobile':'M1: Improper Platform Usage','masvs':'MSTG-STORAGE-3','reference':'https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#logs','description':'The App logs information. Please ensure that sensitive information is never logged.','severity':'INFO'}},'android_certificate_pinning':{'metadata':{'cwe':'CWE-295 Improper Certificate Validation','owasp-mobile':'M3: Insecure Communication','masvs':'MSTG-NETWORK-4','reference':'https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05g-Testing-Network-Communication.md#testing-custom-certificate-stores-and-certificate-pinning-mstg-network-4','description':'This App does not use TLS/SSL certificate or public key pinning to detect or prevent MITM attacks in secure communication channel.','severity':'INFO'}},'android_root_detection':{'metadata':{'cwe':'CWE-919 - Weaknesses in Mobile Applications','owasp-mobile':'M8: Code Tampering','masvs':'MSTG-RESILIENCE-1','reference':'https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05j-Testing-Resiliency-Against-Reverse-Engineering.md#testing-root-detection-mstg-resilience-1','description':'This App does not have root detection capabilities. Running a sensitive application on a rooted device questions the device integrity and affects users data.','severity':'INFO'}},'android_prevent_screenshot':{'metadata':{'cwe':'CWE-200 Information Exposure','owasp-mobile':'M2: Insecure Data Storage','masvs':'MSTG-STORAGE-9','reference':'https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#finding-sensitive-information-in-auto-generated-screenshots-mstg-storage-9','description':'This App does not have capabilities to prevent against Screenshots from Recent Task History/ Now On Tap etc.','severity':'INFO'}},'android_safetynet_api':{'metadata':{'cwe':'CWE-353 Missing Support for Integrity Check','owasp-mobile':'M8: Code Tampering','masvs':'MSTG-RESILIENCE-1','reference':'https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05j-Testing-Resiliency-Against-Reverse-Engineering.md#testing-root-detection-mstg-resilience-1','description':"This App does not uses SafetyNet Attestation API that provides cryptographically-signed attestation, assessing the device's integrity. This check helps to ensure that the servers are interacting with the genuine app running on a genuine Android device. ",'severity':'INFO'}},'android_detect_tapjacking':{'metadata':{'cwe':'CWE-200 Information Exposure','owasp-mobile':'M1: Improper Platform Usage','masvs':'MSTG-PLATFORM-9','reference':'https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05h-Testing-Platform-Interaction.md#testing-for-overlay-attacks-mstg-platform-9','description':"This app does not has capabilities to prevent tapjacking attacks. An attacker can hijack the user's taps and tricks him into performing some critical operations that he did not intend to.",'severity':'INFO'}}},'errors':[]}Configure mobsfscanA.mobsffile in the root of the source code directory allows you to configure mobsfscan. You can also use a custom.mobsffile using--configargument.----ignore-filenames:-skip.javaignore-paths:-__MACOSX-skip_dirignore-rules:-android_kotlin_logging-android_safetynet_api-android_prevent_screenshot-android_detect_tapjacking-android_certificate_pinning-android_root_detection-android_certificate_transparencyseverity-filter:-WARNING-ERRORSuppress FindingsYou can suppress findings from source files by adding the comment// mobsf-ignore: rule_id1, rule_id2to the line that trigger the findings.Example:Stringpassword="strong password";// mobsf-ignore: hardcoded_passwordCI/CD IntegrationsYou can enable mobsfscan in your CI/CD or DevSecOps pipelines.Github ActionAdd the following to the file.github/workflows/mobsfscan.yml.name:mobsfscanon:push:branches:[master,main]pull_request:branches:[master,main]jobs:build:runs-on:ubuntu-lateststeps:-uses:actions/checkout@v2-name:mobsfscanuses:MobSF/mobsfscan@mainwith:args:'.--json'Example:pivaa with mobsfscan github actionGithub Code Scanning IntegrationAdd the following to the file.github/workflows/mobsfscan_sarif.yml.name:mobsfscan sarifon:push:branches:[master,main]pull_request:branches:[master,main]jobs:mobsfscan:runs-on:ubuntu-latestname:mobsfscan code scanningsteps:-name:Checkout the codeuses:actions/checkout@v2-name:mobsfscanuses:MobSF/mobsfscan@mainwith:args:'.--sarif--outputresults.sarif||true'-name:Upload mobsfscan reportuses:github/codeql-action/upload-sarif@v2with:sarif_file:results.sarifGitlab CI/CDAdd the following to the file.gitlab-ci.yml.stages:-testmobsfscan:image:pythonbefore_script:-pip3 install --upgrade mobsfscanscript:-mobsfscan .Example:Travis CIAdd the following to the file.travis.yml.language:pythoninstall:-pip3 install --upgrade mobsfscanscript:-mobsfscan .Circle CIAdd the following to the file.circleci/config.yamlversion:2.1jobs:mobsfscan:docker:-image:cimg/python:3.9.6steps:-checkout-run:name:Install mobsfscancommand:pip install --upgrade mobsfscan-run:name:mobsfscan checkcommand:mobsfscan .DockerPrebuilt image fromDockerHubdockerpullopensecurity/mobsfscan
dockerrun-v/path-to-source-dir:/srcopensecurity/mobsfscan/srcBuild Locallydocker build -t mobsfscan .
docker run -v /path-to-source-dir:/src mobsfscan /src