Authentication and Authorization (`Maintainer` , Viewer`) support in MobSF
* Basic User Management
* Bug Fixes in Runtime Executable Tampering
* Ratelimiting support for login endpoint
* Disable AuthZ/AuthN for REST API and also via ENV VAR `MOBSF_DISABLE_AUTHENTICATION=1`
* Bug Fix#2285
* Bug Fix Icon Analysis Nonetype
* Update SSRF Filter
* Dependency Bump
* Beta to Stable release from V4
* Runs with DEBUG=False
* New home screen UI
iOS Screencast, better swipe
Android Screencast to support touch, swipe and text input events
Android Frida Logs update
Android Improved Screencast
Android Frida spawn, inject and attach support
Added new Android Frida scripts
Replaced Clipdump with Frida script for clipboard monitoring
* iOS Dynamic Analysis Support with Corellium Jailbroken iOS devices
* Corellium API layer for complete device and project management
* Frida instrumentation (attach, spawn and inject) over SSH local port forward
* Shell access over SSH
* MobSF httptools proxy integration over SSH remote port forward
* Device File upload and download over SSH
* Frida scripts for core defense bypass, monitoring, and tracing
* Helper iOS Frida scripts for pentesting and malware analysis
* Screen cast with touch, swipe and text input support from web UI
* Dynamic Analysis device data dump and report Generation
* Android Certificate analysis, replaced oscrypto with cryptography for public key parsing
* Python minimum support is 3.10
* Bumped httptools to latest, fixes httptools repeat bug
* Added unzip to docker to fix a bug
* MobSF Application Security Score Card
* Scorecard API
* Improved App Security Scoring Mechanism
* Improved PDF Report
* Disable CVSSv2 by default.
* For application security use case, use severity levels High, Warning, Low and Secure across all components applicable.
* Non blocking upload flow.
* Fixes#1885
* Move Version to init.py
* Default to Use HOME from MobSF v3.4
* Update Checking improvement
* New Android Rule AES ECB Default
* Update all code locations to dynamically detect config/settings location.
* Rescan Code QA Re: #1670
Check for ZIP Magic on Upload
Support XAPK file format. (Please note that we only scans base APK at this time)
Windows utf-8 safe reads, handle frida exceptions
Tests for XAPK
Fixes: #1573, #1517
* iOS Swift support
* Improved rules for Swift and Objective C
* OWASP MSTG support - https://mobile-security.gitbook.io/masvs/security-requirements/
* Changes to Code Matcher
* Add Status to iOS Permissions
* Standardize IPA binary analysis rules
* Refactoring SAST Code
* Refactor Classdump
* Updated Readme
Thanks to @karolpiateknet (Netguru S. A team)
Ajin Abraham