mobile-security-mobsf
Mobile App Security with MobSF
You are a security engineer performing mobile application security testing using MobSF (Mobile Security Framework).
When to use
Use this skill when asked to perform security analysis on Android (APK/AAB) or iOS (IPA) mobile applications.
Prerequisites
- MobSF running via Docker:
docker run -it --rm -p 8000:8000 opensecurity/mobile-security-framework-mobsf:latest - Verify: access
http://localhost:8000
Instructions
-
Identify the target — Determine the APK, IPA, or source zip file.
-
Run the scan via API:
Upload and scan:
# Upload curl -F "file=@app.apk" http://localhost:8000/api/v1/upload \ -H "Authorization: <api-key>" > upload-response.json # Scan curl -X POST http://localhost:8000/api/v1/scan \ -H "Authorization: <api-key>" \ -d "scan_type=apk&file_name=app.apk&hash=<hash>" > scan-results.json # Get report curl -X POST http://localhost:8000/api/v1/report_json \ -H "Authorization: <api-key>" \ -d "hash=<hash>" > mobsf-report.json -
Parse the results — Present findings:
| # | Severity | Category | Finding | File/Location | CVSS | Remediation |
|---|----------|----------|---------|---------------|------|-------------|
- Summarize — Provide:
- Security score and grade
- Findings by category (binary, code, manifest, network)
- Dangerous permissions requested
- Hardcoded secrets and insecure storage
- Certificate and signing information
Key Checks
| Category | Checks |
|---|---|
| Manifest | Exported components, debuggable flag, backup allowed, permissions |
| Code | Hardcoded secrets, weak crypto, insecure random, logging |
| Binary | PIE, stack canaries, RELRO, NX bit |
| Network | Clear-text traffic, cert pinning, WebView SSL |
| Storage | Shared preferences, SQLite, external storage |
More from vchirrav/product-security-ai-skills
network-scan-nmap
Run Nmap for network discovery and security auditing. Performs port scanning, service detection, OS fingerprinting, and vulnerability script scanning.
34dast-nuclei
Run Nuclei template-based vulnerability scanner. Uses 8000+ community templates to detect CVEs, misconfigurations, exposures, and default credentials on web targets.
17malware-scan-yara
Run YARA rules for pattern-based malware identification. Scans files and directories against community and custom rule sets to detect malicious indicators.
14dast-zap
Run OWASP ZAP for Dynamic Application Security Testing. Performs baseline, full, or API scans against running web applications to find XSS, SQLi, CSRF, and other runtime vulnerabilities.
8api-security-spectral
Run Spectral to lint OpenAPI and AsyncAPI specs for security issues. Validates API design for authentication, authorization, rate limiting, and input validation patterns.
7secure-coding-audit
Audit code for security vulnerabilities using OWASP Secure Coding rules. Automatically detects the security domain (auth, API, Docker, K8s, CI/CD, etc.) and validates against the relevant checklist rules, citing specific Rule IDs.
7