Skip to content
THREATWIRE

MobSF

Automated mobile app security testing

Mobile Security Framework: automated static and dynamic analysis of Android and iOS apps, with malware analysis and a REST API for CI.

Open sourceGPL-3.0-only
Alternative toNowSecure
Visit website View repository Docs
Homepage of MobSF
Official website (mobsf.github.io), captured by ThreatWire.

What MobSF does

MobSF analyses APK, AAB, IPA and source archives statically, reporting issues such as insecure permissions, hard-coded secrets, weak crypto and manifest problems. Dynamic analysis on Android emulators or devices adds runtime instrumentation with Frida, traffic capture and API monitoring.

A web interface and REST API let teams run it manually or as part of a mobile CI pipeline.

Key features

  • Static analysis of Android and iOS apps
  • Dynamic analysis with Frida instrumentation
  • Malware and tracker indicators
  • Web UI and REST API
  • Docker deployment

Licence

GPL-3.0-only · GNU GPL v3 · Open source

Checked by ThreatWire against the repository's licence file on 2026-10-20. GitHub detects: GPL-3.0.

Security of MobSF itself

27 published advisories for MobSF in GitHub repository advisories and OSV.dev; the 12 most recent are listed. Keep the tool updated: security tools often run with broad access.

  • GHSA-hh7q-v28p-p55mmedium2026-09-21

    Cross-Site Request Forgery via GET-based dynamic analysis actions

  • GHSA-m83p-3cgp-6p8cmedium2026-09-21

    Path traversal in iOS IPA icon extraction via unvalidated CFBundleExecutable allows restricted app/image read

  • GHSA-3fr8-jfgg-fm3xmedium2026-09-21

    Server-Side Request Forgery (SSRF) via X-Forwarded-Host Header in /httptools Endpoint

  • GHSA-cvhc-xjjc-c4p3low2026-09-21

    Denial of service via APK decompression bomb in the bundled apkinspector ZIP reader

  • GHSA-c8g7-42qj-frj3medium2026-09-21

    Windows-only path traversal via root-relative paths bypasses is_path_traversal()

  • GHSA-95px-34x5-p37hCVE-2026-68927low2026-07-05

    SSRF port restriction bypass in assetlinks_check

  • GHSA-x768-8642-mmq9CVE-2026-68924medium2026-07-05

    Zip Bomb Denial of Service via Per-File Size Limit Bypass in ZIP/APK Extraction

  • GHSA-3p54-567p-2wprCVE-2026-68923medium2026-07-05

    Regression: CSRF checks not enforced after Django migration

  • GHSA-8j49-mmcx-4mp5CVE-2026-68922medium2026-07-05

    Arbitrary File Read via Path Traversal in ZIP Uploads

  • GHSA-hqjr-43r5-9q58CVE-2026-33545medium2026-03-21

    SQL Injection in SQLite Database Viewer utils

  • GHSA-8hf7-h89p-3pqjCVE-2026-24490high2026-01-26

    Stored XSS via Manifest Analysis - Dialer Code Host Field

  • GHSA-9gh8-9r95-3fc3CVE-2025-58162medium2025-08-31

    Arbitrary File Write (AR-Slip) via Absolute Path in .a Extraction

Sources: GitHub repository advisories, OSV.dev · checked 2026-10-20.

Categories and tags

Mobile application security#android#ios#static-analysis#dynamic-analysis#mobsf#android-security#mobile-security#windows-mobile-security

Related tools

  • Frida

    Dynamic instrumentation toolkit

    Injects a JavaScript engine into running processes on Windows, macOS, Linux, iOS and Android to trace, hook and modify functions at runtime.

    Stars
    22k
    Forks
    2.3k
    Last commit
    today
    LGPL-2.0-or-later WITH WxWindows-exception-3.1Open sourceMobile application security
    Alternative toNowSecure

  • Apktool

    Reverse engineering tool for Android APK files

    Decodes Android APK resources and code to a near-original form (smali) and rebuilds them after modification, for analysis and testing.

    Stars
    26k
    Forks
    4.1k
    Last commit
    2 days ago
    Apache-2.0Open sourceMobile application security
Share on X@threatwire_https://www.threatwire.tech/tools/mobsf