MobSF/Mobile-Security-Framework-MobSF
1
0
Fork 0
mirror of https://github.com/MobSF/Mobile-Security-Framework-MobSF.git synced 2026-10-12 02:06:59 +00:00
Code Issues Packages Projects Releases Wiki Activity
1,869 Commits 6 Branches 58 Tags
941f7c5dd493019edb14ceaee1ca1c5e11fa6726
Commit Graph
1869 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Ajin Abraham 941f7c5dd4 [HOTFIX] iOS Framework Analysis + Multiple Feature QA (#2260) 
* iOS Framework Analysis
* Static Analysis URL simplification
* Replace hardcoded urls in template with `{% url %}`
* Code QA
* Remove unwanted template file
* Remove `rescan` query param from url
* Android icon SVG guessing improvements
* Icon analysis refactoring, change icon storage location
* Remove SVG to PNG converter. Support PNG and SVG icon.
* Github docker release action update
 2023-09-06 23:55:06 -07:00
Ajin Abraham 3c2a2f1ee6 [HOTFIX] simplify scan api (#2259) 
* Simplify Scan API
* Need only scan hash to trigger a scan
* Updated API Docs
 2023-09-04 15:12:36 -07:00
Ajin AbrahamandMark Sowell c5967615f1 [HOTFIX] Bump Frida to address crash on M1 Mac (#2258) 
* Update frida to 16.1.4 to resolve segmentation faults on Docker arm image
---------

Co-authored-by: Mark Sowell <[email protected]>
 2023-09-04 13:11:11 -07:00
Ajin Abraham cc4a59ee76 [HOTFIX] add jar (#2255) 
* Add apksigner jar
 2023-08-31 21:59:09 -07:00
Ajin Abraham bba141d2fd [HOTFIX] add apksigner.jar for reading signatures (#2254) 
* Add `apksigner.jar`
* Use apksigner to extract signature versions (v1, v2, v3, v4)
* Fix: #2120
 2023-08-31 21:52:48 -07:00
Ajin Abraham e6cee553d6 Performance Improvements on SAST (#2251) 
* Performance improvements in SAST scans (Code Analysis, API Analysis, NIAP etc.) with libsast bump
* Android API rule QA
* Manifest analysis continuation on apktool failure
* Linux setup script fix
* Disable NIAP by default
 2023-08-30 00:03:07 -07:00
Ajin Abraham bb700fa071 [HOTFIX] Migrate from setup.py to poetry, tox QA (#2249) 
* Migrate from setup.py to use poetry build and publish
* Tox QA
* Version is now configured only at pyproject.toml
* Added poetry build test
* Updated mobsf PyPI publishing workflow 
* Update local DBs
v3.7.6 		2023-08-27 21:08:29 -07:00
Ajin Abraham 6e329c0d3f [HOTFIX] bs4 malformed xml parsing + xml namespace detection (#2248) 
* Use BeautifulSoup4 to prettify malformed XML
* Detect non standard XML namespace in AndroidManifest.xml (Fixes : https://github.com/MobSF/Mobile-Security-Framework-MobSF/issues/2198) 
* Updated android permissions list
* Updated android permission update check script
 2023-08-26 18:32:07 -07:00
Ajin Abraham 74f100de90 [HOTFIX] Docker Buildx test (#2247) 
* Docker image build test for PRs
 2023-08-26 11:45:39 -07:00
Ajin Abraham 8e29cb06a6 Pip to Poetry, Ubuntu Base image Bump, Dockerfile QA, Python 3.11 support (#2244) 
* Docker base image update
* Docker file QA
* Github Actions version update
* Removed unwanted pinned repository
* Pip to Poetry migration
* Bump httptools
* Jump yara-python-dex
* Python 3.11 support
 2023-08-25 21:15:28 -07:00
Ajin Abraham f965183a0e [HOTFIX][EFR10] Independent Static Library(.a) ELF/MachO Analysis + Graceful Analysis (#2242) 
* Independent Static Library(.a) ELF/MachO Analysis
   * Mac FAT binary only supported on Mac
* Static and Dynamic Binary Analysis QA
* Refactor Dex permissions
* Fallback certificate analysis using apksigtool
* Refactor Androguard `apk.APK()` usage
 2023-08-24 18:39:56 -07:00
Ajin Abraham c2993d1944 [HOTFIX][EFR09] AAR/JAR obfuscation and debug check + Exception Handed strings and symbols extraction (#2240) 
* AAR/JAR obfuscation and debug check
* Exception handling symbols and strings from so/dylib
 2023-08-19 00:19:55 -07:00
Abb4d0nandAjin Abraham d681353aaa Fix missing exported components (#2176) 
Components which are exported and have no permission were not listed in the results because of a wrong template description key.
Also added a warning if this happens again.

Co-authored-by: Ajin Abraham <[email protected]>
 2023-08-18 18:50:58 -07:00
Ajin Abraham e08524fe81 [HOTFIX][EFR-08] Dylib + Symbols + Other Features (#2239) 
* Dylib analysis support + PDF for iOS Binary
* Dylib string extraction
* Improved iOS Plist secret extraction
* iOS/Android Form Validation QA
* Independent Dylib scan
* Symbols view for dylib and so
* Trackers support for so
 2023-08-18 17:53:45 -07:00
Ajin.Abraham b1be6f54da HOTFIX: fix IPA download support 2023-08-16 14:42:30 -07:00
KarmazandAjin Abraham 2b7156c7cc Update macho_analysis.py - SYMBOLS STRIPPED False Negative (#2234) 
* Update macho_analysis.py

PR for this issue: 
https://github.com/MobSF/Mobile-Security-Framework-MobSF/issues/2233

* Update macho_analysis.py


Co-authored-by: Ajin Abraham <[email protected]>
 2023-08-15 09:47:26 -07:00
Ajin Abraham 19e0963162 HOTFIX: Improve code string extraction 2023-08-14 17:10:15 -07:00
Ajin Abraham 2854114b28 [HOTFIX][EFR06] Independent Shared Object (.so) Scan and Improved String search (#2228) 
* String extraction from APK, Source, AAR, JAR, SO
* Strings sections to show source of strings extracted
* Strings Refactor
* Support for independent .SO scan
* Android SCA rules update
* Entropies scan support for strings
* URLs/Email extraction refactor
* Bug Fixes
  * iOS Source Report Fix
  * Frida APK Patcher (WIP)
  * Dynamic Analyzer identifier not available
  * Settings env var not working fix for enabled by default features
  * AppSec Score fix
  * Recent `scan not completed` fix for iOS zip
 2023-08-14 11:47:55 -07:00
Ajin Abraham 28b7fdeca5 [HOTFIX] Regex + Rule Update (#2232) 
* IOS Swift Rules updates
  *  Updated or added rules `ios_biometric_bool`, `ios_biometric_acl`, `ios_keychain_weak_acl_device_passcode`, `ios_keychain_weak_accessibility_value`, `ios_insecure_random_no_generator`, `ios_biometry_hardened`
 * Regex Hardening: Fixes possible Regex DoS in rules and MobSF code base
 2023-08-10 01:16:12 -07:00
Ajin Abraham 9e57c5767d Dynamic Analysis support alert (#2227) 2023-08-02 00:46:01 -07:00
Ajin Abraham 9ae65e682a HOTFIX: translate upstream proxy ip for docker 2023-08-01 16:46:51 -07:00
superpoussin22andAjin Abraham 14e9382668 update apktool (#2225) 
Co-authored-by: Ajin Abraham <[email protected]>
 2023-07-31 00:58:21 -07:00
superpoussin22 808cacba9a update apktool to 2.8.1 (#2220) 2023-07-31 00:55:38 -07:00
Ajin Abraham 218954d3e7 Hotfix: Handle Docker <-> ADB connectivity internally (#2219) 
* host.docker.internal transilation for localhost

* Replace urlparse with re

* version bump

* update ascii art
 2023-07-25 13:19:06 -07:00
Ajin Abraham 1fde1cfa6d Update dynamic_analysis.html (#2218) 2023-07-24 23:49:41 -07:00
Ajin Abraham b1d4abcab4 Hotfix: Broken donate link fix 2023-07-24 18:32:37 -07:00
Ajin Abraham 8c25cb21aa Hotfix: Add Corellium support message 2023-07-24 18:02:19 -07:00
Ajin Abraham a54faf8dec Hotfix: Docker error fixes 2023-07-24 17:52:54 -07:00
Ajin Abraham 3c7c9afecd Update setup.py 2023-07-23 12:48:17 -07:00
Ajin Abraham d021da6eab HOTFIX: MobSF Android Dynamic Analysis Docker Support (#2214) 
* MobSF Android Docker Support

* Pin pip version

* Update mobsf-test.yml
v3.6.9 		2023-07-21 23:41:45 -07:00
Ajin Abraham dc0dc273e5 HOTFIX: Feature updates and Bug Fixes (#2197) 
* OFAC, jquery bump, tox fix
* AAR handle multiple application tags
 2023-06-22 15:13:01 -07:00
Ajin Abraham b608ce46dc Revert Hotfix 2023-06-21 15:59:50 -07:00
Ajin Abraham 89efdeebcc HOTFIX: update lief 2023-06-21 15:55:07 -07:00
Ajin Abraham c7578b8735 Update requirements.txt 
0.13.1 not available.
 2023-06-14 14:12:51 -07:00
pyup.io botandAjin Abraham d2f0603d66 Scheduled weekly dependency update for week 24 (#2187) 
* Update ip2location from 8.9.0 to 8.10.0

* Update quark-engine from 22.10.1 to 23.5.1

* Update LIEF from to 0.13.1

* Update tldextract from 3.4.0 to 3.4.4

* Update requirements.txt

---------

Co-authored-by: Ajin Abraham <[email protected]>
 2023-06-14 13:59:48 -07:00
Ajin Abraham b1922d8a0d Enable binary analysis for aar/jar 2023-05-20 11:23:44 -07:00
Ajin Abraham b43b561a65 [EFR05] Enterprise Feature Request: AAR and JAR support (#2163) 
* AAR and JAR support
 2023-04-17 12:02:02 -07:00
Ajin Abraham 0cd255cb90 [Enterprise Feature Request EFR02] Support summary of severity in each section. (#2160) 
* Summary for Android and iOS SCA
 2023-04-10 14:57:02 -07:00
Ajin Abraham a13bf58c55 HOTFIX: Android min SDK check on janus vulnerability detection (#2159) 
* Android min SDK  check on janus check

* Update README.md
 2023-04-07 20:02:43 -07:00
Ajin.Abraham 93432c961a Merge branch 'master' of github.com:MobSF/Mobile-Security-Framework-MobSF 2023-03-30 14:02:57 -07:00
Ajin.Abraham bfef7e6285 HOTFIX: Fixes #2144 2023-03-30 14:02:40 -07:00
Ajin Abraham be23758bc6 [HOTFIX] Add support for environment variable for MobSF config (#2150) 
* add support for environment variable config
* Fixes #2109
* update lief
 2023-03-30 12:20:35 -07:00
Ajin Abraham 6bc642813c HOTIX: Update Dockerfile to install jq (#2149) 
* Update Dockerfile

* Update tox.ini
 2023-03-28 00:23:02 -07:00
antoinbo 6c64d17229 Fix Scorecard Severity Distribution chart data (#2140) 2023-03-15 18:12:39 -07:00
Ajin Abraham 7ad41a454e HOTFIX: Fix docker build (#2135) 2023-02-17 15:40:43 -08:00
evmxattrandnone 1f249c4f2a Support for filenames containing & (#2129) 
Co-authored-by: none <[email protected]>
 2023-02-08 21:13:57 -08:00
Ajin Abraham aeaa9b122a New Android Manifest Rule: App support vulnerable android versions (#2114) 
* add a new rule: dangerous os version

* qa

* lint checks

* run lint test on one os
 2023-01-11 09:49:20 -08:00
Ajin.Abraham 5ccb028cc6 version bump 2023-01-10 17:38:06 -08:00
Ajin.Abraham 0b259d015d HOTFIX: Icon should be a file 2023-01-10 17:37:23 -08:00
superpoussin22 1016a3d069 Apktool 2.7.0 update (#2082) 
* Update apktool to version 2.7.0
 2022-12-13 11:19:47 -08:00