{"id":13533115,"url":"https://github.com/MobSF/mobsfscan","last_synced_at":"2025-04-01T21:31:45.779Z","repository":{"id":44664109,"uuid":"334505414","full_name":"MobSF/mobsfscan","owner":"MobSF","description":"mobsfscan is a static analysis tool that can find insecure code patterns in your Android and iOS source code. Supports Java, Kotlin, Swift, and Objective C Code. mobsfscan uses MobSF static analysis rules and is powered by semgrep and libsast  pattern matcher.","archived":false,"fork":false,"pushed_at":"2025-01-31T23:23:41.000Z","size":339,"stargazers_count":649,"open_issues_count":9,"forks_count":105,"subscribers_count":8,"default_branch":"main","last_synced_at":"2025-03-25T06:46:10.603Z","etag":null,"topics":["android","appsec","codereview","ios","java","kotlin","mobile-sast","objective-c","sast","security","static-analysis","swift"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"lgpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/MobSF.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":".github/FUNDING.yml","license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null},"funding":{"github":"ajinabraham","custom":["https://opensecurity.in/donate"]}},"created_at":"2021-01-30T20:31:30.000Z","updated_at":"2025-03-24T15:15:50.000Z","dependencies_parsed_at":"2023-12-10T01:43:49.073Z","dependency_job_id":"09ded247-2f43-49bf-b544-626bc835bd2a","html_url":"https://github.com/MobSF/mobsfscan","commit_stats":{"total_commits":143,"total_committers":15,"mean_commits":9.533333333333333,"dds":0.2097902097902098,"last_synced_commit":"9bb23767a2a3fa95599bf6fb9df29553e70303ae"},"previous_names":[],"tags_count":31,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/MobSF%2Fmobsfscan","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/MobSF%2Fmobsfscan/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/MobSF%2Fmobsfscan/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/MobSF%2Fmobsfscan/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/MobSF","download_url":"https://codeload.github.com/MobSF/mobsfscan/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":245543400,"owners_count":20632647,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["android","appsec","codereview","ios","java","kotlin","mobile-sast","objective-c","sast","security","static-analysis","swift"],"created_at":"2024-08-01T07:01:16.680Z","updated_at":"2025-04-01T21:31:45.768Z","avatar_url":"https://github.com/MobSF.png","language":"Python","readme":"# mobsfscan\n**mobsfscan** is a static analysis tool that can find insecure code patterns in your Android and iOS source code. Supports Java, Kotlin, Android XML, Swift and Objective C Code. mobsfscan uses [MobSF](https://github.com/MobSF/Mobile-Security-Framework-MobSF) static analysis rules and is powered by [semgrep](https://github.com/returntocorp/semgrep) and [libsast](https://github.com/ajinabraham/libsast) pattern matcher.\n\nMade with ![Love](https://cloud.githubusercontent.com/assets/4301109/16754758/82e3a63c-4813-11e6-9430-6015d98aeaab.png) in India  [![Tweet](https://img.shields.io/twitter/url?url=https://github.com/MobSF/mobsfscan)](https://twitter.com/intent/tweet/?text=mobsfscan%20is%20a%20static%20analysis%20tool%20that%20can%20find%20insecure%20code%20patterns%20in%20your%20Android%20and%20iOS%20source%20code.%20Supports%20Java,%20Kotlin,%20Swift,%20and%20Objective%20C%20Code.%20by%20%40ajinabraham%20%40OpenSecurity_IN\u0026url=https://github.com/MobSF/mobsfscan)\n\n[![PyPI version](https://badge.fury.io/py/mobsfscan.svg)](https://badge.fury.io/py/mobsfscan)\n[![License](https://img.shields.io/:license-lgpl3.0+-blue.svg)](https://www.gnu.org/licenses/lgpl-3.0.en.html)\n[![python](https://img.shields.io/badge/python-3.7+-blue.svg)](https://www.python.org/downloads/)\n[![platform](https://img.shields.io/badge/platform-osx%2Flinux-green.svg)](https://github.com/MobSF/mobsfscan/)\n[![Build](https://github.com/MobSF/mobsfscan/workflows/Build/badge.svg)](https://github.com/MobSF/mobsfscan/actions?query=workflow%3ABuild)\n\n### Support mobsfscan\n\n[![Donate to MobSF](https://user-images.githubusercontent.com/4301109/117404264-7aab5480-aebe-11eb-9cbd-da82d7346bb3.png)](https://opensecurity.in/donate)\n\nIf you liked mobsfscan and find it useful, please consider donating.\n\n## e-Learning Courses \u0026 Certifications\n![MobSF Course](https://user-images.githubusercontent.com/4301109/76344880-ad68b580-62d8-11ea-8cde-9e3475fc92f6.png) [Automated Mobile Application Security Assessment with MobSF -MAS](https://opsecx.com/index.php/product/automated-mobile-application-security-assessment-with-mobsf/)\n\n![Android Security Tools Course](https://user-images.githubusercontent.com/4301109/76344939-c709fd00-62d8-11ea-8208-774f1d5a7c52.png) [Android Security Tools Expert -ATX](https://opsecx.com/index.php/product/android-security-tools-expert-atx/)\n\n\n## Installation\n\n`pip install mobsfscan`\n\nRequires Python 3.7+\n\n## Command Line Options\n\n```bash\n$ mobsfscan\nusage: mobsfscan [-h] [--json] [--sarif] [--sonarqube] [--html] [--type {android,ios,auto}]\n                 [-o OUTPUT] [-c CONFIG] [-mp {default,billiard,thread}] [-w] [--no-fail] [-v]\n                 [path ...]\n\npositional arguments:\n  path                  Path can be file(s) or directories with source code\n\noptions:\n  -h, --help            show this help message and exit\n  --json                set output format as JSON\n  --sarif               set output format as SARIF 2.1.0\n  --sonarqube           set output format compatible with SonarQube\n  --html                set output format as HTML\n  --type {android,ios,auto}\n                        optional: force android or ios rules explicitly\n  -o OUTPUT, --output OUTPUT\n                        output filename to save the result\n  -c CONFIG, --config CONFIG\n                        location to .mobsf config file\n  -mp {default,billiard,thread}, --multiprocessing {default,billiard,thread}\n                        optional: specify multiprocessing strategy\n  -w, --exit-warning    non zero exit code on warning\n  --no-fail             force zero exit code, takes precedence over --exit-warning\n  -v, --version         show mobsfscan version\n```\n\n\n## Example Usage\n\n```bash\n$ mobsfscan tests/assets/src/\n- Pattern Match ████████████████████████████████████████████████████████████ 3\n- Semantic Grep ██████ 37\n\nmobsfscan: v0.3.0 | Ajin Abraham | opensecurity.in\n╒══════════════╤════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╕\n│ RULE ID      │ android_webview_ignore_ssl                                                                                                                             │\n├──────────────┼────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤\n│ DESCRIPTION  │ Insecure WebView Implementation. WebView ignores SSL Certificate errors and accept any SSL Certificate. This application is vulnerable to MITM attacks │\n├──────────────┼────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤\n│ TYPE         │ RegexAnd                                                                                                                                               │\n├──────────────┼────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤\n│ PATTERN      │ ['onReceivedSslError\\\\(WebView', '\\\\.proceed\\\\(\\\\);']                                                                                                  │\n├──────────────┼────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤\n│ SEVERITY     │ ERROR                                                                                                                                                   │\n├──────────────┼────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤\n│ INPUTCASE    │ exact                                                                                                                                                  │\n├──────────────┼────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤\n│ CVSS         │ 7.4                                                                                                                                                    │\n├──────────────┼────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤\n│ CWE          │ CWE-295 Improper Certificate Validation                                                                                                                │\n├──────────────┼────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤\n│ OWASP-MOBILE │ M3: Insecure Communication                                                                                                                             │\n├──────────────┼────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤\n│ MASVS        │ MSTG-NETWORK-3                                                                                                                                         │\n├──────────────┼────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤\n│ REF          │ https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05g-Testing-Network-Communication.md#webview-server-certificate-verification                │\n├──────────────┼────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤\n│ FILES        │ ╒════════════════╤═════════════════════════════════════════════════════════════════════════════════════════════╕                                       │\n│              │ │ File           │ ../test_files/android_src/app/src/main/java/opensecurity/webviewignoressl/MainActivity.java │                                       │\n│              │ ├────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────┤                                       │\n│              │ │ Match Position │ 1480 - 1491                                                                                 │                                       │\n│              │ ├────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────┤                                       │\n│              │ │ Line Number(s) │ 50                                                                                          │                                       │\n│              │ ├────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────┤                                       │\n│              │ │ Match String   │ .proceed();                                                                                 │                                       │\n│              │ ├────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────┤                                       │\n│              │ │ File           │ ../test_files/android_src/app/src/main/java/opensecurity/webviewignoressl/MainActivity.java │                                       │\n│              │ ├────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────┤                                       │\n│              │ │ Match Position │ 1331 - 1357                                                                                 │                                       │\n│              │ ├────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────┤                                       │\n│              │ │ Line Number(s) │ 46                                                                                          │                                       │\n│              │ ├────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────┤                                       │\n│              │ │ Match String   │ onReceivedSslError(WebView                                                                  │                                       │\n│              │ ╘════════════════╧═════════════════════════════════════════════════════════════════════════════════════════════╛                                       │\n╘══════════════╧════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╛\n```\n\n## Python API\n\n```python\n\u003e\u003e\u003e from mobsfscan.mobsfscan import MobSFScan\n\u003e\u003e\u003e src = 'tests/assets/src/java/java_vuln.java'\n\u003e\u003e\u003e scanner = MobSFScan([src], json=True)\n\u003e\u003e\u003e scanner.scan()\n{\n    'results': {\n        'android_logging': {\n            'files': [{\n                'file_path': 'tests/assets/src/java/java_vuln.java',\n                'match_position': (13, 73),\n                'match_lines': (19, 19),\n                'match_string': '            Log.d(\"htbridge\", \"getAllRecords(): \" + records.toString());'\n            }],\n            'metadata': {\n                'cwe': 'CWE-532 Insertion of Sensitive Information into Log File',\n                'owasp-mobile': 'M1: Improper Platform Usage',\n                'masvs': 'MSTG-STORAGE-3',\n                'reference': 'https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#logs',\n                'description': 'The App logs information. Please ensure that sensitive information is never logged.',\n                'severity': 'INFO'\n            }\n        },\n        'android_certificate_pinning': {\n            'metadata': {\n                'cwe': 'CWE-295 Improper Certificate Validation',\n                'owasp-mobile': 'M3: Insecure Communication',\n                'masvs': 'MSTG-NETWORK-4',\n                'reference': 'https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05g-Testing-Network-Communication.md#testing-custom-certificate-stores-and-certificate-pinning-mstg-network-4',\n                'description': 'This App does not use TLS/SSL certificate or public key pinning to detect or prevent MITM attacks in secure communication channel.',\n                'severity': 'INFO'\n            }\n        },\n        'android_root_detection': {\n            'metadata': {\n                'cwe': 'CWE-919 - Weaknesses in Mobile Applications',\n                'owasp-mobile': 'M8: Code Tampering',\n                'masvs': 'MSTG-RESILIENCE-1',\n                'reference': 'https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05j-Testing-Resiliency-Against-Reverse-Engineering.md#testing-root-detection-mstg-resilience-1',\n                'description': 'This App does not have root detection capabilities. Running a sensitive application on a rooted device questions the device integrity and affects users data.',\n                'severity': 'INFO'\n            }\n        },\n        'android_prevent_screenshot': {\n            'metadata': {\n                'cwe': 'CWE-200 Information Exposure',\n                'owasp-mobile': 'M2: Insecure Data Storage',\n                'masvs': 'MSTG-STORAGE-9',\n                'reference': 'https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#finding-sensitive-information-in-auto-generated-screenshots-mstg-storage-9',\n                'description': 'This App does not have capabilities to prevent against Screenshots from Recent Task History/ Now On Tap etc.',\n                'severity': 'INFO'\n            }\n        },\n        'android_safetynet_api': {\n            'metadata': {\n                'cwe': 'CWE-353 Missing Support for Integrity Check',\n                'owasp-mobile': 'M8: Code Tampering',\n                'masvs': 'MSTG-RESILIENCE-1',\n                'reference': 'https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05j-Testing-Resiliency-Against-Reverse-Engineering.md#testing-root-detection-mstg-resilience-1',\n                'description': \"This App does not uses SafetyNet Attestation API that provides cryptographically-signed attestation, assessing the device's integrity. This check helps to ensure that the servers are interacting with the genuine app running on a genuine Android device. \",\n                'severity': 'INFO'\n            }\n        },\n        'android_detect_tapjacking': {\n            'metadata': {\n                'cwe': 'CWE-200 Information Exposure',\n                'owasp-mobile': 'M1: Improper Platform Usage',\n                'masvs': 'MSTG-PLATFORM-9',\n                'reference': 'https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05h-Testing-Platform-Interaction.md#testing-for-overlay-attacks-mstg-platform-9',\n                'description': \"This app does not has capabilities to prevent tapjacking attacks. An attacker can hijack the user's taps and tricks him into performing some critical operations that he did not intend to.\",\n                'severity': 'INFO'\n            }\n        }\n    },\n    'errors': []\n}\n```\n\n## Configure mobsfscan\n\nA `.mobsf` file in the root of the source code directory allows you to configure mobsfscan. You can also use a custom `.mobsf` file using `--config` argument.\n\n```yaml\n---\n- ignore-filenames:\n  - skip.java\n\n  ignore-paths:\n  - __MACOSX\n  - skip_dir\n\n  ignore-rules:\n  - android_kotlin_logging\n  - android_safetynet_api\n  - android_prevent_screenshot\n  - android_detect_tapjacking\n  - android_certificate_pinning\n  - android_root_detection\n  - android_certificate_transparency\n\n  severity-filter:\n  - WARNING\n  - ERROR\n```\n## Suppress Findings\n\nYou can suppress findings from source files by adding the comment `// mobsf-ignore: rule_id1, rule_id2` to the line that trigger the findings.\n\nExample:\n\n```java\nString password = \"strong password\"; // mobsf-ignore: hardcoded_password\n```\n\n## CI/CD Integrations\n\nYou can enable mobsfscan in your CI/CD or DevSecOps pipelines.\n\n#### Github Action\n\nAdd the following to the file `.github/workflows/mobsfscan.yml`.\n\n```yaml\nname: mobsfscan\n\non:\n  push:\n    branches: [ master, main ]\n  pull_request:\n    branches: [ master, main ]\n\njobs:\n  build:\n    runs-on: ubuntu-latest\n    steps:\n    - uses: actions/checkout@v4.2.2\n    - uses: actions/setup-python@v5.3.0\n      with:\n        python-version: '3.12'\n    - name: mobsfscan\n      uses: MobSF/mobsfscan@main\n      with:\n        args: '. --json'\n```\nExample: [pivaa with mobsfscan github action](https://github.com/MobSF/pivaa/actions/workflows/mobsfscan.yml)\n\n#### Github Code Scanning Integration\nAdd the following to the file `.github/workflows/mobsfscan_sarif.yml`.\n\n```yaml\nname: mobsfscan sarif\non:\n  push:\n    branches: [ master, main ]\n  pull_request:\n    branches: [ master, main ]\n\njobs:\n  mobsfscan:\n    runs-on: ubuntu-latest\n    name: mobsfscan code scanning\n    steps:\n    - name: Checkout the code\n      uses: actions/checkout@v4.2.2\n    - uses: actions/setup-python@v5.3.0\n      with:\n        python-version: '3.12'\n    - name: mobsfscan\n      uses: MobSF/mobsfscan@main\n      with:\n        args: '. --sarif --output results.sarif || true'\n    - name: Upload mobsfscan report\n      uses: github/codeql-action/upload-sarif@v2\n      with:\n        sarif_file: results.sarif\n```\n![mobsfscan github code scanning](https://user-images.githubusercontent.com/4301109/118427198-839be300-b681-11eb-8b79-92b916ffe3ef.png)\n\n#### Gitlab CI/CD\n\nAdd the following to the file `.gitlab-ci.yml`.\n\n```yaml\nstages:\n    - test\nmobsfscan:\n    image: python\n    before_script:\n        - pip3 install --upgrade mobsfscan\n    script:\n        - mobsfscan .\n```\nExample: \n\n\n#### Travis CI\n\nAdd the following to the file `.travis.yml`.\n\n```yaml\nlanguage: python\ninstall:\n    - pip3 install --upgrade mobsfscan\nscript:\n    - mobsfscan .\n```\n\n#### Circle CI\n\nAdd the following to the file `.circleci/config.yaml`\n\n```yaml\nversion: 2.1\njobs:\n  mobsfscan:\n    docker:\n      - image: cimg/python:3.9.6\n    steps:\n      - checkout\n      - run:\n          name: Install mobsfscan\n          command: pip install --upgrade mobsfscan\n      - run:\n           name: mobsfscan check\n           command: mobsfscan .\n```\n\n## Docker\n\n### Prebuilt image from [DockerHub](https://hub.docker.com/r/opensecurity/mobsfscan)\n\n```bash\ndocker pull opensecurity/mobsfscan\ndocker run -v /path-to-source-dir:/src opensecurity/mobsfscan /src\n```\n\n### Build Locally\n\n```\ndocker build -t mobsfscan .\ndocker run -v /path-to-source-dir:/src mobsfscan /src\n```\n","funding_links":["https://github.com/sponsors/ajinabraham","https://opensecurity.in/donate"],"categories":["SAST","Static Application Security Testing","静态分析","Python"],"sub_categories":[],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FMobSF%2Fmobsfscan","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FMobSF%2Fmobsfscan","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FMobSF%2Fmobsfscan/lists"}