diff --git a/README.md b/README.md index fea78caf..5417936e 100644 --- a/README.md +++ b/README.md @@ -37,6 +37,14 @@ If you liked MobSF and find it useful, please consider donating. *It's easy to build open source, try maintaining a project once. Long live open source!* ## Documentation + +Quick setup + +``` +docker pull opensecurity/mobile-security-framework-mobsf:latest +docker run -it --rm -p 8000:8000 opensecurity/mobile-security-framework-mobsf:latest +``` + [![See MobSF Documentation](https://user-images.githubusercontent.com/4301109/70686099-3855f780-1c79-11ea-8141-899e39459da2.png)](https://mobsf.github.io/docs) [![See MobSF Documentation in Chinese](https://user-images.githubusercontent.com/4301109/117404947-b09d0880-aebf-11eb-9db8-3d7360f47914.png)](https://mobsf.github.io/docs/#/zh-cn/) [![See MobSF Documentation in Japanese](https://user-images.githubusercontent.com/4301109/148662149-7ee671b4-66a2-4232-9522-276b8e88d924.png)](https://mobsf.github.io/docs/#/ja-jp/) @@ -69,15 +77,6 @@ If you liked MobSF and find it useful, please consider donating. * For Project updates and announcements, follow [@ajinabraham](https://twitter.com/ajinabraham) or [@OpenSecurity_IN](https://twitter.com/OpenSecurity_IN). * Github Issues are only for tracking bugs and feature requests. Do not post support or help queries there. We have a slack channel for that. -### Launching MobSF Rewards - -Contributed to MobSF? Here is a big thank you from our community to you. Claim your badge, a soulbound NFT and showcase them with pride. Let us inspire more folks ! - -![MobSF Badges](https://aviyel.com/assets/uploads/rewards/share/project/7/512/share.png) - -[Claim Now!](https://aviyel.com/projects/7/mobile-security-framework/rewards) - - ### Static Analysis - Android ![mobsf_android_static_analysis](https://user-images.githubusercontent.com/4301109/95506503-f9b6c980-097d-11eb-803a-f88321e1feb7.gif) diff --git a/mobsf/StaticAnalyzer/views/android/cert_analysis.py b/mobsf/StaticAnalyzer/views/android/cert_analysis.py index f0033dc4..b55ca249 100755 --- a/mobsf/StaticAnalyzer/views/android/cert_analysis.py +++ b/mobsf/StaticAnalyzer/views/android/cert_analysis.py @@ -18,6 +18,7 @@ from django.utils.html import escape logger = logging.getLogger(__name__) logging.getLogger('androguard').setLevel(logging.ERROR) +ANDROID_8_1_LEVEL = 27 def get_hardcoded_cert_keystore(files): @@ -46,7 +47,7 @@ def get_hardcoded_cert_keystore(files): logger.exception('Getting Hardcoded Certificates/Keystores') -def cert_info(app_dir, app_file): +def cert_info(app_dir, app_file, man_dict): """Return certificate information.""" try: logger.info('Reading Code Signing Certificate') @@ -128,7 +129,9 @@ def cert_info(app_dir, app_file): 'Missing Code Signing certificate')) if a.is_signed_v1(): status = 'high' - if a.is_signed_v2() or a.is_signed_v3(): + api_level = int(man_dict['min_sdk']) + if ((a.is_signed_v2() or a.is_signed_v3()) + and api_level < ANDROID_8_1_LEVEL): status = 'warning' findings.append(( status, diff --git a/mobsf/StaticAnalyzer/views/android/static_analyzer.py b/mobsf/StaticAnalyzer/views/android/static_analyzer.py index 3d8fe5d5..a67abd91 100755 --- a/mobsf/StaticAnalyzer/views/android/static_analyzer.py +++ b/mobsf/StaticAnalyzer/views/android/static_analyzer.py @@ -197,7 +197,8 @@ def static_analyzer(request, api=False): elf_dict = elf_analysis(app_dic['app_dir']) cert_dic = cert_info( app_dic['app_dir'], - app_dic['app_file']) + app_dic['app_file'], + man_data_dic) apkid_results = apkid_analysis(app_dic[ 'app_dir'], app_dic['app_path'], app_dic['app_name']) tracker = Trackers.Trackers(