Commit Graph
1975 Commits
Author SHA1 Message Date
Ajin Abraham 3cf21cec16 4.1.9 (#2449)
* Anti-analysis bypass
   - JADX fallback to DEX files on APK decompilation failure
   - apktool fallback to androguard for AndroidManifest.xml extraction
   - apksigner.jar fallback to apksigtool/androguard for signature version extraction
   - Graceful erorrs for failures instead of exceptions
2024-11-11 15:44:03 -08:00
Ajin Abraham 70e243d661 4.1.8 (#2448)
* APKID QA.
* Bash and Batch file script QA.
* Android Report template optimizations on how exported components are displayed.
* Clickable Android Activities, Services, Providers and Recievers.
* Updated Android version support to 11.0 for Android Studio AVD.
* Created helper scripts for AVDs `scripts/start_avd.sh` and `scripts/start_avd.ps1`.
2024-11-10 00:44:20 -08:00
Ajin Abraham 76596e33ed docker compose QA, explict requests timeout (#2447)
* Dependency update
* Explicit timeout for all requests
* Support proxy for all http(s) calls
* Optimize jadx download, support system proxy
2024-11-08 17:05:49 -08:00
Ajin Abraham ee2cb73824 Add support for pulling split apks, Fixes #2271 (#2446)
* Add support for pulling split apks from device, Fixes #2271
* Replace Quark with Behaviour analysis using quark rules
2024-11-07 19:34:37 -08:00
Ajin Abraham e5af3a8219 4.1.5 (#2445)
* Support custom home from environment variables
* Reduce iOS binary findings severity to warning from high
* Code QA and dependency updates
* docker-compose QA, added example nginx config
* Added docker-compose_swarm.yml by @antonkap add support for docker secrets
* IPA PNG Uncrush support for Windows and Linux #2397
2024-11-06 22:59:01 -08:00
Ajin Abraham e4406e9479 [HOTFIX] + Features (#2444)
Add support for sample download in recent scans.
Bug fix in firebase analysis (dict mutation errors)
2024-11-05 18:14:56 -08:00
Ajin Abraham 66af98f3ec libsast bump 2024-11-04 16:35:42 -08:00
Ajin Abraham 17f3f028ff HOTFIX: Libsast bump (#2443)
* Libsast bump
* Bump libsast to address match case
v4.1.3
2024-11-04 13:06:11 -08:00
Ajin Abraham 3f947c0226 Hotfix: Firebase + Dep bumps 2024-11-02 21:19:39 -07:00
Ajin Abraham 6947649b18 Multiple Features (Scan timeout, Firebase Remote Config, Search Scans) (#2441)
Support time out for SAST and Binary scans
Search by MD5, package name, file name and app name.
Search REST API + docs + tests
Firebase remote config check [FEATURE] Add support for Firebase Remote Config information  #2429
autopep8
2024-10-29 00:51:13 -07:00
Ajin Abraham d817c0bf18 HOTFIX: Update wkhtmltopdf and dependencies 2024-10-28 03:35:56 -07:00
Ajin Abraham 6f3f7a2531 HOTFIX: Postgres env var 2024-10-28 02:44:02 -07:00
Ajin Abraham 9b2a3c8552 [HOTFIX] Dockerfile and dependency upgrade, Bug Fixes (#2439)
* Dockerfile: migrate from Ubuntu to Debian Bookworm
* Update and MachO and ELF Analysis
* Update docker compose with postgres
* JDK bump to 22.0.2
* Python bump to 3.12
* Bump jadx, apktool, vd2svg, bundletool
* Remove jadx from repo and download it dynamically during setup
* Install jadx during docker build
* Replace deprecated dependencies
* Bump httptools
* Postgres Support by default
* Bump LIEF to latest, reintroduce PIE checks for ELF
* Fixes #2430 #2432 #2395
* Bug Fixes
2024-10-28 02:36:51 -07:00
Ajin Abraham fec37069f3 [HOTFIX] dep bups + Fix #2424 v4.0.7 2024-10-08 16:45:20 -07:00
Ayushman Chhabra f6193dc1b6 Check for internet before attempting to download APK (#2422)
* Check for internet before attempting to download APK
2024-09-20 14:13:07 -07:00
Ajin Abraham 8ebe4982d9 Bump deps (#2426) 2024-09-20 08:57:30 -07:00
Ajin Abraham cc625fe843 [SECURITY][HOTFIX] Fixes GHSA-4hh3-vj32-gr6j (#2421)
* Fixes GHSA-4hh3-vj32-gr6j
* update SECURITY.md
* update dependencies
2024-08-18 02:07:14 -07:00
Ajin Abraham 5b7c5c0075 [EFR][HOTFIX] Realtime Scan status and logs (#2416)
* Realtime Scan Status in UI and PDF reports
* Scan Status REST API & tests
* Fixes #2414
* Address #2413
* Code QA
* Dependency and version bump
2024-08-04 12:07:38 -07:00
Ajin Abraham 1fdc718b07 Update SECURITY.md (#2418) 2024-07-31 11:57:39 -07:00
Ajin Abraham fdaad81314 HOTFIX: Fix and OpenRedirect vulnerability 2024-07-31 11:51:27 -07:00
Ajin Abraham a9de0335d4 [HOTFIX] AppSec PNW 2024, Deeplink Trigger Support for Android Dynamic Analyzer (#2402)
* iOS  Dynamic Analyzer String Compare Frida script improvement
* Android Dynamic Analyzer Deeplink UI trigger support 
* Android & iOS Dynamic Analyzer UI Improvements
* Android & iOS Dynamic Analyzer Bug fixes
2024-07-25 21:30:09 -07:00
Ajin Abraham 39ba3e64be [HOTFIX] Code QA (#2393)
* QA
* Add new android rule setAllow*FromFileURLs
* android root bypass and debugger bypass scripts improvements
* Dockerfile qa
* prevent entrypoint exit if username already exists
2024-06-02 16:37:00 -07:00
Ajin Abraham 680ca5d302 [HOTFIX] Support AAB with MobSF, Convert AAB to APK, Fixes #2387 (#2391)
* AAB to APK conversion
* relative urls fix for recent scan
2024-05-24 20:46:23 -07:00
Ajin Abraham e35782328f Pagination support for recent scans 2024-05-24 16:34:44 -07:00
Ajin Abraham 94175956a0 QA 2024-05-24 16:34:22 -07:00
Ajin Abraham cf390e2863 Merge branch 'master' into master 2024-05-24 12:34:44 -07:00
Ajin Abraham 8b97723817 HOTFIX: Fix docker run errors 2024-05-23 23:32:13 -07:00
Ajin Abraham aeba044014 [HOTFIX] SSO Support hosts behind proxy (#2390)
* Added support for proxy setup and custom SP host
2024-05-23 13:05:27 -07:00
Ajin Abraham b46c0037ac [EFR][HOTFIX] SSO Support + Okta SSO Documentation (#2389)
* Add support for SSO with SAML2.0
* Bump Deps
* Docs Updated
* Bump MobSF version
2024-05-22 21:27:49 -07:00
Ajin Abraham 76187b805f [EFR] AuthZ and AuthN for MobSF + Bug Fixes (#2366)
Authentication and Authorization (`Maintainer` , Viewer`) support in MobSF
* Basic User Management
* Bug Fixes in Runtime Executable Tampering
* Ratelimiting support for login endpoint
* Disable AuthZ/AuthN for REST API and also via ENV VAR `MOBSF_DISABLE_AUTHENTICATION=1`
* Bug Fix #2285 
* Bug Fix Icon Analysis Nonetype
* Update SSRF Filter
* Dependency Bump
* Beta to Stable release from V4
* Runs with DEBUG=False
* New home screen UI
2024-05-21 10:08:01 -07:00
Ajin Abraham 4549ebd9d7 Update home.py 2024-05-20 10:30:07 -07:00
Ajin Abraham 7ee126639e Lint fixes 2024-05-20 10:20:53 -07:00
miaoyc 7d5553bcdc Merge branch 'master' into master 2024-05-09 16:14:16 +08:00
Ajin Abraham 31026cbacd Update auto-comment.yml 2024-05-03 20:08:42 -07:00
Ajin Abraham 126eb78c3a Update CONTRIBUTING.md 2024-05-03 20:08:06 -07:00
Ajin Abraham 84d52a999a Update SUPPORT.md (#2384) 2024-05-03 20:07:25 -07:00
Ajin Abraham fb853e8865 Update bug_report.md 2024-05-03 20:06:20 -07:00
Ajin Abraham 485d31f1ac Update README.md (#2383) 2024-05-03 20:02:09 -07:00
miaoyc 63ca7dca78 feat(page): recent records add page jump 2024-04-05 11:37:06 +08:00
miaoyc 86c48ae99a feat(page): recent records add page jump 2024-04-04 23:44:32 +08:00
miaoyc 0dac1eb163 Merge branch 'MobSF:master' into master 2024-04-04 20:31:50 +08:00
Ajin Abraham 99977da400 Update SECURITY.md 2024-04-03 21:50:07 -07:00
Ajin Abraham 43bb71d115 [HOTFIX][SECURITY] Fixes an SSRF vulnerability report from positive technologies (#2373)
Address: https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-wpff-wm84-x5cx
2024-04-03 21:47:14 -07:00
miaoyc 912c407d84 Merge branch 'MobSF:master' into master 2024-04-03 16:43:51 +08:00
ohyeah521andAjin Abraham 6bce5a25b4 Resolve the situation where the function name is bytes (#2367)
fix error:
 if function.name.endswith('_chk'):
       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
TypeError: endswith first arg must be bytes or a tuple of bytes, not str

Co-authored-by: Ajin Abraham <[email protected]>
v3.9.7
2024-03-24 14:56:26 -07:00
Ajin Abraham ccfedc0e45 HOTFIX: Possible SSRF 2024-03-23 19:15:30 -07:00
Ajin.Abraham 8a59d6833d HOTFIX: Build and push docker arm64 and amd64 together 2024-03-22 18:19:17 -07:00
Ajin Abraham 482bda913f Update SECURITY.md 2024-03-22 17:11:10 -07:00
Ajin Abraham 356895c611 Update SECURITY.md (#2365) 2024-03-22 17:10:34 -07:00
Ajin Abraham 3a7d12488c Update SECURITY.md (#2364) 2024-03-22 17:03:04 -07:00