Get Even More Visitors To Your Blog, Upgrade To A Business Listing >>
Idioma: En

Mobile Security Framework (MobSF) - An All-In-One Mobile Application Security Assessment Framework


Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.

MobSF support mobile app binaries (APK, IPA & APPX) along with zipped source code and provides REST APIs for seamless integration with your CI/CD or DevSecOps pipeline.The Dynamic Analyzer helps you to perform runtime security assessment and interactive instrumented testing.

Screenshots:

  • Static Analysis - Android



  • Static Analysis - iOS


  • Dynamic Analysis - Android APK



  • Web API Viewer

Requirements:

  • Mac:
    • Install Git
    • Install Python 3.6 - 3.7 (3.8 is not supported)
    • macOS Catalina users must uninstall existing python3 and install the one from Python.org. After installation, go to /Applications/Python 3.7/ and run Install Certificates.command and Update Shell Profile.command
    • Install JDK 8+
    • Install command line tools xcode-select --install
    • Download & Install wkhtmltopdf as per the wiki instructions
    • macOS Mojave users, install headers if available: 
sudo installer -pkg /Library/Developer/CommandLineTools/Packages/macOS_SDK_headers_for_macOS_10.14.pkg -target /

  • Ubuntu/Debian based Linux:
    • Install Git sudo apt get install git
    • Install Python 3.6 - 3.7 sudo apt-get install python3
    • Install JDK 8+ sudo apt-get install openjdk-8-jdk
    • Install the following dependencies 
sudo apt install python3-venv python3-pip python3-dev build-essential libffi-dev libssl-dev libxml2-dev libxslt1-dev libjpeg8-dev zlib1g-dev wkhtmltopdf

  • Windows:
    • Install Git
    • Install Python 3.7
    • Install JDK 8+
    • Install Microsoft Visual C++ Build Tools
    • Install OpenSSL
    • Download & Install wkhtmltopdf as per the wiki instructions
    • Add the folder that contains wkhtmltopdf binary to environment variable PATH.
    • Windows App Static analysis requires a Windows Host or Windows VM for Mac and Linux. 
If you are running MobSF in Windows host, you do not have to configure anything, apart from interacting with the automated installation script for the first time when you run MobSF. However, if you are using a different host OS, you need to configure a Windows VM. Sadly binskim is only available on Windows. So even for static analysis, a Windows VM is required.

Steps on the Windows-VM:
  • Install the following requirements on the VM
    • Python 3
    • rsa (via python -m pip install rsa)
  • Download the setup.py script and run it
  • There is some manual interaction, but if there are no errors, everything is good and the RPC-Server should be running.
Remember: Use separate Windows-VM for MobSF and don't expose it to a network range where an attack might be coming from. The best solution is to set it to host-only mode.

  • To integrate a Windows-VM into MobSF, please follow these steps. 
    • Get the IP of you VM and set in the MobSF/settings.py-File (search for WINDOWS_VM_IP)
    • (If not yet done:) Copy the private rsa key from the vm to MobSF



If you see errors like this:
Unhandled Exception: System.NotSupportedException: The requested security protocol is not supported.
   at System.Net.ServicePointManager.set_SecurityProtocol(SecurityProtocolType value)
   at NuGet.CommandLine.Program.MainCore(String workingDirectory, String[] args)
   at NuGet.CommandLine.Program.Main(String[] args)
Install .NET Framework 4.6
AttributeError: ConfigParser instance has no attribute 'getitem'
MobSF setup script assume that your VM or host Windows box have a C Drive and you have all the permissions to perform read/write operations in C:\MobSF. This error occurs if you don't have proper read/write permissions.

IMPORTANT:
  • Set JAVA_HOME environment variable.
  • iOS IPA Analysis works only on Mac, Linux and Docker containers.

Dynamic Analysis:

  • Dynamic Analysis will not work if you use MobSF docker container or setup MobSF inside a Virtual Machine.
  • Install Genymotion

Installation:

Tested on Windows 10, Ubuntu (18.04, 19.04) , macOS Catalina
# Please make sure that all the requirements mentioned above are installed first.

git clone https://github.com/MobSF/Mobile-Security-Framework-MobSF.git
cd Mobile-Security-Framework-MobSF
# Linux or Mac users
./setup.sh 
# Windows users
setup.bat
IMPORTANT: Windows users, before running setup.bat close any opened folders of MobSF or text editors with MobSF opened. Either of these can interrupt the setup by causing permission errors.

Running MobSF

  • For Linux and Mac: ./run.sh
  • For Windows: run.bat
You can navigate to http://localhost:8000/ to access MobSF web interface.

    Configuring Dynamic Analyzer

    Dynamic analysis using a real mobile phone is not supported.

    Run a Genymotion Android VM before starting MobSF. Everything will be configured automatically at runtime. MobSF requires Genymotion Android x86 VMs version 4.1 to 9.0 for dynamic analysis. We recommend using Android 7.0 and above.

    Android versions 5 and above are automatically MobSFyed on first run. For Android versions less than 5, you must MobSFy the Android Runtime prior to Dynamic Analysis for the first time. Click MobSFy Android Runtime button in Dynamic Analysis page to MobSFy the android runtime environment.

    HTTPS Proxy
    • For Android versions 4.4 - 9.0, global proxy settings are automatically applied at runtime.
    • For Android version 4.1 - 4.3, set Android VM proxy as displayed in Dynamic Analysis page.
    If Dynamic Analyzer doesn't detect your android device, you need to manually configure ANALYZER_IDENTIFIER in MobSF/settings.py. Example: ANALYZER_IDENTIFIER = '192.168.56.101:5555'. You can find the Android Device IP from the Genymotion title bar and the default port is 5555.


    MobSF Docker Container

    Lazy to setup MobSF? Use the latest MobSF docker image (Dynamic Analysis is not supported)
    docker pull opensecurity/mobile-security-framework-mobsf
    # Static Analysis Only
    docker run -it -p 8000:8000 opensecurity/mobile-security-framework-mobsf:latest

    MobSF e-Learning Courses & Certification

    We have 2 self paced e-learning courses that covers MobSF and other Android Security tools.
    • OpSecX - Automated Mobile Application Security Assessment with MobSF – MAS (Currently being updated)
    • OpSecX - Android Security Tools Expert – ATX

      Updating MobSF

      If you are updating MobSF, In most cases you might have to perform database migrations or you will see errors such as
      [ERROR] Saving to DB (E:\Mobile-Security-Framework-MobSF\StaticAnalyzer\views\android\db_interaction.py, LINE 236 "static_db.save()"): table StaticAnalyzer_staticanalyzerandroid has no column named

      Run the below command to migrate your db
      python manage.py makemigrations
      python manage.py makemigrations StaticAnalyzer
      python manage.py migrate
      If the above changes didn't work, you might have to run setup.sh or setup.bat again which will delete your previous scan results.

      APKiD

      APKiD is enabled by default. To disable it, set APKID_ENABLED to False in MobSF/settings.py.

      VirusTotal Scan

      VirusTotal Scan is disabled by default. You need to add your VirusTotal API Key before enabling it.
      • Get VirusTotal API Key here
      • Access your API Key from https://www.virustotal.com/en/user/[username]/apikey/.
      • In MobSF/settings.py, add your API Key to VT_API_KEY and set VT_ENABLED to True and restart MobSF.

      AppMonsta Android Play Store Information

      We use AppMonsta API to fetch details from Google Play Store as a fail safe to our primary implementation. It is disabled by default. To enable it, you need AppMonsta API Key.
      • Get AppMonsta API Key from: AppMonsta API Key
      • In MobSF/settings.py, add your API Key to APPMONSTA_KEY and restart MobSF.

      Mass Static Analysis

      MobSF supports mass static analysis. Here is how to run a mass static analysis:
      • Run MobSF server.
      python manage.py runserver 8000
      • Run mass_static_analysis.py
      usage: mass_static_analysis.py [-h] [-d DIRECTORY] [-s IPPORT]

      optional arguments:
        -h, --help            show this help message and exit
        -d DIRECTORY, --directory DIRECTORY
                              Path to the directory that contains mobile app
                              binary/zipped source code
        -s IPPORT, --ipport IPPORT
                              IP address and Port number of a running MobSF Server.
                              (ex: 127.0.0.1:8000)
      Example: python mass_static_analysis.py -s 127.0.0.1:8000 -d /home/files/ 

      Using Postgres DB instead of SQLite:

      Install psycopg2: pip3 install psycopg2-binary

      Go to MobSF\settings.py

      Comment the following:
      DATABASES = {
          'default': {
              'ENGINE': 'django.db.backends.sqlite3',
              'NAME': DB_DIR,
          }
      }

      Now uncomment the following:
      DATABASES = {
          'default': {
              'ENGINE': 'django.db.backends.postgresql_psycopg2',
              'NAME': 'mobsf',
              'USER': 'postgres',
              'PASSWORD': '',
              'HOST': 'localhost',
              'PORT': '',
          }
      }

      Create a database in Postgres named mobsf and configure the above settings with correct username, password and other details.

      Apply Migrations:
      python3 manage.py makemigrations
      python3 manage.py migrate
      Now you can start MobSF server and you have successfully configured Postgres as your database.

      Home Directory Support:

      If you want all user uploads, downloads and user configurations to be created in home directory, enable home directory support:

      To provide personalized version of MobSF to multiple users on an OS or to bundle MobSF with a pentesting distro you might need the home directory support enabled.

      To enable Home Directory support, go to settings.py and set USE_HOME to True. 
      USE_HOME = True

      This will ensure
      • All the user uploads, database, and downloads are now created in .MobSF directory under user's home directory.
      • User configurations are read from .MobSF/config.py in home directory. If the format is incorrect or the file is not found, user configurations are read from MobSF/settings.py itself.

      Docker Image for MobSF Static Analysis

      Building Image from Dockerfile
      git clone https://github.com/MobSF/Mobile-Security-Framework-MobSF.git
      cd Mobile-Security-Framework-MobSF
      docker build -t mobsf .
      docker run -it -p 8000:8000 mobsf
      This will run MobSF at 0.0.0.0:8000

      Building Image behind a proxy from Dockerfile
      docker build --build-arg https_proxy="http://proxy_ip:proxy_port" --build-arg http_proxy="proxy_ip:proxy_port" --build-arg NO_PROXY="127.0.0.1" -t mobsf .
      (replace `proxy_ip` with the value of your proxy ip address and `proxy_port` with the proxy port used

      Rebuilding Image from Dockerfile from Scratch
      docker rmi ubuntu:18.04
      docker build --no-cache --rm -t mobsf .

      Prebuilt MobSF Docker Image
      https://hub.docker.com/r/opensecurity/mobile-security-framework-mobsf/
      docker pull opensecurity/mobile-security-framework-mobsf
      docker run -it --name mobsf -p 8000:8000 opensecurity/mobile-security-framework-mobsf:latest

      For persistence
      docker run -it --name mobsf -p 8000:8000 -v :/root/.MobSF opensecurity/mobile-security-framework-mobsf:latest

      For postgres support
      You will need docker-compose : see https://docs.docker.com/compose/install/
      • build the images docker-compose build
      • launch the services docker-compose up -d (in background) or docker-compose up (in foreground)
      Then verify the 2 services are up:
      docker ps
      CONTAINER ID        IMAGE                                   COMMAND                  CREATED             STATUS              PORTS                          NAMES
      7de107c5b853        mobile-security-framework-mobsf_mobsf   "python3 manage.py r…"   5 weeks ago         Up 5 weeks          0.0.0.0:8000->8000/tcp         mobile-security-framework-mobsf_mobsf_1
      149a3ffa61ca        postgres:latest                         "docker-entrypoint.s…"   5 weeks ago         Up 5 weeks          5432/tcp                       mobile-security-framework-mobsf_postgres_1

      If you don't want to use docker-compose, you will need to start a postgres container first , then to start MobSF using the dockerfile and setting POSTGRES variable to True.
      docker build --build-arg POSTGRES=True -t mobsf .

      You can change postgres connection information in postgres_support.sh Do it before building the image
      #!/bin/bash
      set -e
      POSTGRES=$1
      echo "Postgres support : ${POSTGRES}"
      if [ "$POSTGRES" == True ]; then
       echo "Installing Postgres"
       pip3 install psycopg2-binary
       #Enable postgres support
       sed -i '/# Sqlite3 suport/,/# End Sqlite3 support/d' ./MobSF/settings.py && \
       sed -i "/# Postgres DB - Install psycopg2/,/'''/d" ./MobSF/settings.py && \
       sed -i "/# End Postgres support/,/'''/d" ./MobSF/settings.py && \
       sed -i "s/'PASSWORD': '',/'PASSWORD': 'password',/" ./MobSF/settings.py && \
       sed -i "s/'HOST': 'localhost',/'HOST': 'postgres',/" ./MobSF/settings.py
      fi

      If you have error at first Launch
      docker exec -it mobile-security-framework-mobsf_mobsf_1 python3 manage.py makemigrations
      docker exec --it mobile-security-framework-mobsf_mobsf_1 python3 manage.py migrate

      **To see what's happened in container if launched with -d instead of -it: **
      docker logs -f --tail 100 mobsf

      To have a shell access in the container
      docker exec -it  mobsf /bin/bash

      REST API

      MobSF provides REST APIs. You can access API docs from within the app.

      CI/CD

      For CI/CD you can take advantage of MobSF REST API.

      MobSF CI/CD pipeline integration
      • Using Docker App:
      docker-app render omerl/mobsf-ci:0.3.0 --set target_folder= --set target_apk= --set output_folder= | docker-compose -f - up --exit-code-from scan
      To parse the report, use OWASP Glue.

      Usage:
      • Clone the repo
      • Create a folder named target in the root folder, and place the target there (e.g. target/my_app.apk).
      • Run the tests using:
      TARGET_PATH='target/' docker-compose up --build --exit-code-from scan
      • Wait for the command to complete, it will take some time. When the command will be completed, checkout the report under output/report.json.
      • Use OWASP Glue to process the report by running:
      docker run -it -v $(pwd)/output:/app owasp/glue:raw-latest ruby bin/glue -t Dynamic -T /app/report.json --mapping-file mobsf --finding-file-path /app/android.json -z 2

      Running Tests:

      You can run all the unit tests with tox -e lint,test (lint doesn't work on windows) 

      Presentations:

      • OWASP APPSEC EU 2016


      • NULLCON 2016


      • c0c0n 2015

      • G4H Webcast 2015

      Download MobSF

      You might also like:
      • Sniffly2 - Sniffing Browser History Using HSTS
      • InfernalWireless - Automated Wireless Hacking Tool
      • Linux Malware Detect - Malware Scanner for Linux
      • CredCrack - A Fast and Stealthy Credential Harvester
      • Inveigh - Windows PowerShell LLMNR/mDNS/NBNS Spoofer/Man-In-The-Middle Tool
      • Cowrie - SSH/Telnet Honeypot
      • AntiCuckoo - A Tool To Detect & Crash Cuckoo Sandbox
      • usbkill - An Anti-Forensic Kill Switch
      • Gcat - A Fully Featured Backdoor That Uses Gmail As a C&C Server
      • Web Security Dojo - A Self-Contained Penetration Testing Training Environment
      • Woodpecker hash Bruteforce - A Powerful Hash Cracker
      • WiFi-Pumpkin - Framework for Rogue WiFi Access Point Attack
      • Pupy - A Cross-platform Remote Administration and Post-Exploitation Tool
      • PortExpert - Tool For Monitoring All Applications Connected To the Internet
      • Mobius Forensic Toolkit - Forensics Framework To Manage Cases & Case Items

      Related Articles



      This post first appeared on Effect Hacking - Hacking Tools, How To Guides An, please read the originial post: here

      Share the post

      Mobile Security Framework (MobSF) - An All-In-One Mobile Application Security Assessment Framework

      ×

      Subscribe to Effect Hacking - Hacking Tools, How To Guides An

      Get updates delivered right to your inbox!

      Thank you for your subscription

      ×