Mobile
MobSF
Mobile Security Framework for static and basic dynamic analysis of iOS and Android builds.
What it is
MobSF ingests an IPA/APK (and source, when provided) and reports permissions, transport security, secrets in resources, and common API misuse. It is the static first pass on mobile jobs. Dynamic features need a lab device or emulator, never a personal phone.
Reach for it when
Mobile assessments once you have a signed test build and, for dynamic, a lab device that the RoE covers.
Watch-outs
Uploading a client IPA to a public MobSF cloud is distribution of their app. Run local. Do not decrypt production keystores. Dynamic analysis that intercepts traffic still needs the BFF to be in scope and, for fintech, synthetic data only.
Typical invocation
Run a local MobSF instance and upload the TestFlight IPA; export the PDF into the engagement evidence pack.
Authorized assessments only. Stay inside the rules of engagement.
Pin to a kit
Open an engagement first.
Related
- Frida
Dynamic instrumentation toolkit for lab iOS/Android processes during authorized mobile tests.
- objection
Runtime mobile exploration toolkit built on Frida, for lab-device assessments.
- Burp Suite
Intercepting proxy and scanner for authorized web and API testing, mapping, and manual review.