* APKID QA.
* Bash and Batch file script QA.
* Android Report template optimizations on how exported components are displayed.
* Clickable Android Activities, Services, Providers and Recievers.
* Updated Android version support to 11.0 for Android Studio AVD.
* Created helper scripts for AVDs `scripts/start_avd.sh` and `scripts/start_avd.ps1`.
* Support custom home from environment variables
* Reduce iOS binary findings severity to warning from high
* Code QA and dependency updates
* docker-compose QA, added example nginx config
* Added docker-compose_swarm.yml by @antonkap add support for docker secrets
* IPA PNG Uncrush support for Windows and Linux #2397
Support time out for SAST and Binary scans
Search by MD5, package name, file name and app name.
Search REST API + docs + tests
Firebase remote config check [FEATURE] Add support for Firebase Remote Config information #2429
autopep8
* Dockerfile: migrate from Ubuntu to Debian Bookworm
* Update and MachO and ELF Analysis
* Update docker compose with postgres
* JDK bump to 22.0.2
* Python bump to 3.12
* Bump jadx, apktool, vd2svg, bundletool
* Remove jadx from repo and download it dynamically during setup
* Install jadx during docker build
* Replace deprecated dependencies
* Bump httptools
* Postgres Support by default
* Bump LIEF to latest, reintroduce PIE checks for ELF
* Fixes#2430#2432#2395
* Bug Fixes
Authentication and Authorization (`Maintainer` , Viewer`) support in MobSF
* Basic User Management
* Bug Fixes in Runtime Executable Tampering
* Ratelimiting support for login endpoint
* Disable AuthZ/AuthN for REST API and also via ENV VAR `MOBSF_DISABLE_AUTHENTICATION=1`
* Bug Fix#2285
* Bug Fix Icon Analysis Nonetype
* Update SSRF Filter
* Dependency Bump
* Beta to Stable release from V4
* Runs with DEBUG=False
* New home screen UI
This PR strips out androguard and it's dependencies from MobSF.
Extract androguard related functions used by MobSF.
Some dependencies such as pyQt5 from apkinspector is breaking the ARM64 docker image.
This should address that issue.
In future, we will have to copy over any fixes to axml, apk, public, types from androguard and ZipEntry from apkinspector.
We won't be adding linting to these files. The extracted functions will be considered as an external tool.
* [SECURITY] Fixes an LFI reported by @0x33c0unt - A crafted APK resource with icon name containing arbitrary path will get copied by MobSF as the icon file to the download directory which is available under `/download/` route. Fixed by https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/a58f8a8c0aa49e1581d97e19e8e2255ca96cd838
* Fixes#2324 , Bug in parsing DSA Public Key parameters for fingerprint calculation.
* Update dependencies
* Replace Android test APK
* Added tests for Library analysis from binary (scan_library route)
* iOS merge findings from swift and objective c rules with same rule identifier. Fixes#2287
* iOS Binary analysis, sort regex matches. Fixes#2252
* Framework dylibs with no extensions to skip PIE checks. Fixes#2307
* Select correct network_security config. Fixes#2049
* Android Manifest Analysis added support for detecting task hijacking (StrandHogg 1.0 and StrandHogg 2.0) . Fixes#2124
* Added new manifest analysis rule to warn on apps targeting older Android OS
* Updated severity of findings
* UI improvement for AppSec dashboard to show a loader
* UI changes in Static Analysis to collapse large no of files in API and Code Analysis for better real estate
* Improved certificate file analysis for android, jar, aar, and ios
* MobSF version Bump
* Scan independent library file (.so, .dylib, Framework dylib) from APK/IPA Static Analysis Report
* Library analysis refactored relative path helper for Django template.
* Re-introduced RELRO checks for Android, added Dart binary check to avoid Flutter false positives.
* Improved stripped debug symbol check for ELF and MachO using native OS tools such as nm and objdump when available.
* Merge iOS Framework and Dylib Analysis.
iOS Screencast, better swipe
Android Screencast to support touch, swipe and text input events
Android Frida Logs update
Android Improved Screencast
Android Frida spawn, inject and attach support
Added new Android Frida scripts
Replaced Clipdump with Frida script for clipboard monitoring
* iOS Dynamic Analysis Support with Corellium Jailbroken iOS devices
* Corellium API layer for complete device and project management
* Frida instrumentation (attach, spawn and inject) over SSH local port forward
* Shell access over SSH
* MobSF httptools proxy integration over SSH remote port forward
* Device File upload and download over SSH
* Frida scripts for core defense bypass, monitoring, and tracing
* Helper iOS Frida scripts for pentesting and malware analysis
* Screen cast with touch, swipe and text input support from web UI
* Dynamic Analysis device data dump and report Generation
* Android Certificate analysis, replaced oscrypto with cryptography for public key parsing
* Python minimum support is 3.10
* Bumped httptools to latest, fixes httptools repeat bug
* Added unzip to docker to fix a bug
* Migrate from setup.py to use poetry build and publish
* Tox QA
* Version is now configured only at pyproject.toml
* Added poetry build test
* Updated mobsf PyPI publishing workflow
* Update local DBs
Ajin Abraham