Skip to content

Releases: MobSF/Mobile-Security-Framework-MobSF

v4.3.0

24 Jan 00:41
@ajinabraham ajinabraham
v4.3.0
d1d3b7a
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v4.3.0 Latest
Latest

v4.3.0 Changelog

  • Features or Enhancements

    • Added django-q2-based asynchronous scans for Android and iOS binaries and source code
    • Async analysis REST API support & Docs
    • Unified async scan timeout
    • Allow incomplete scan delete after async scan timeout duration
    • Added support for Android SBOM analysis
    • Added Anti-analysis bypasses
    • Handle packed APKs, refactor unzip to handle malformed APK files
    • Handle reserved filename conflict during ZIP extraction
    • Fixed permissions of extracted files to counter anti-analysis techniques
    • JADX fallback to DEX files on APK decompilation failure
    • apktool fallback to androguard for AndroidManifest.xml extraction
    • Resolved APK parsing errors in androguard
    • apksigner.jar fallback to apksigtool/androguard for signature version extraction
    • Added explicit timeout for all HTTP requests
    • Support proxy for all HTTPS calls
    • Optimize jadx download, support system proxy
    • Replaced Quark with Behaviour Analysis using ported quark rules
    • Add support for pulling split apks from Android Dynamic Analyzer
    • Add support for sample download in recent scans.
    • Support custom home directory from environment variables
    • Reduce iOS binary findings severity to warning from high
    • QA on docker-compose, added example nginx config
    • Added docker-compose_swarm.yml and docker secrets support by @antonkap
    • IPA PNG Uncrush support for Windows and Linux
    • Automatically handle https upgrade for http urls in Android Assetlinks check
    • APKID QA.
    • Bash and Batch file script QA.
    • Android Report template optimizations on how exported components are displayed.
    • Clickable Android Activities, Services, Providers, and Recievers
    • Updated Android version support to 11.0 for Android Studio AVD
    • Created helper scripts for AVDs scripts/start_avd.sh and scripts/start_avd.ps1
    • Added malware lookup using SHA2 with VirusTotal, Triage, Hybrid Analysis, and MetaDefender
    • Optimized APK ZIP analysis for improved performance
    • Fixed untar permission errors in dynamic analysis
    • Added bypass for SSL pinning in Boye's AbstractVerifier
    • Updated bypass for SSL pinning in Appmattus's CertificateTransparencyInterceptor
    • Introduced SSL pinning detector script
    • Improved Frida intent dumper script
    • Added Frida intent tracer script
    • Enabled asynchronous scans in Docker Compose setup
    • Performed QA for Android and iOS SAST modules
    • Added Frida script for audit-webview
    • Introduced Frida script for trace-javascript-interface
    • Upgraded libsast for improved file reading, multiprocessing, and multithreading
    • Fixed PNG crush issues on Darwin systems
    • Performed QA on the home screen UI
    • Updated httptools and libsast dependencies
    • Improvements in scan queue
    • Added a robots.txt
    • Code QA untar permissions
    • Added and updated permission mapping rules
    • Handle errors gracefully from get_app_name and icon_analysis
    • Add new scans in tasks view without needing and explicit refresh
    • Optimizing downloads, adding downloads for source code types and windows appx
    • Androguard, ApkInspector code bump
    • Patch Androguard AXML to log a warning on parse error reserved must be zero! instead of raise
    • Fallback on get app name when androguard returns empty string
    • Bump to google fork of baksmali 3.0.8
    • IPA: Graceful handling of plist dump exception
    • Dockerfile QA
    • Add sdk-build-tools to Docker image
    • Replace biplist with plistlib std lib
    • Added support for APK parsing with aapt2/aapt
    • Use aapt/aapt2 as a fallback for APK parsing, files listing and string extraction
    • Tasks List API to return string status
    • Replaced all minidom calls with defusedxml.minidom
    • Code QA on android manifest data extraction and parsing
    • Improved android file analysis
    • Improved android manifest data extraction
    • Improved android icon file extraction
    • Improved android app name extraction
    • Improved android appstore package details extraction
    • Android string extraction to fallback on aapt2 strings
    • APK analysis arguments refactor
    • Explicit Zipslip handling during ZIP extraction
    • Graceful files extraction on unzip failure
    • Removed bail out and continue analysis
    • Moved androguard parsing to the start of static analysis
    • AndroidManifest.xml fallback from apktool to androguard during extraction and parsing
    • Updated Tasks UI to show started at
    • Save only unique intent priorities in findings
    • Add files list in scorecard description

  • Bug Fixes

    • Bug fix in firebase analysis
    • Fixed bug in certificate analysis.
    • Fix TOCTOU in delete scans view
    • Bug fix in enqueue model schema
    • Bug Fix in app_dict init.
    • Fixed a bug in iOS pbxproj parsing
    • Fixed a bug executing setup.sh script in python venv

What's Changed

New Contributors

Full Changelog: v4.1.3...v4.3.0

Contributors

dmarushkin, ajinabraham, and 3 other contributors
Assets 2
Loading

v4.1.3

05 Nov 00:30
@ajinabraham ajinabraham
v4.1.3
17f3f02
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v4.1.3

v4.1.3 Changelog

  • Features or Enhancements
    • Improvement in SAST performance with libsast upgrade.
    • Address a bug that cause SAST scans to timeout.
    • Added Firebase Remote Config Check
    • Add support for searching scans by package name, app name and file name
    • Exposed a REST API for search
    • Add timeouts for each scan steps
    • Added Autopep8 for code linting
    • Added postgres support by default and updated docs to enable postgres support
    • Upgraded docker file and dependencies
    • Support Python 3.12

What's Changed

Full Changelog: v4.0.7...v4.1.3

Contributors

ajinabraham
Assets 2
Loading

v4.0.7

09 Oct 00:02
@ajinabraham ajinabraham
v4.0.7
fec3706
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v4.0.7

v4.0.7 Changelog

  • Features or Enhancements

    • Support Authentication & Authorization in MobSF
    • Added support for SSO + Okta SSO Documentation
    • Promoted from Beta to Stable since v4.0.0
    • Added Pagination support for recent scans
    • Added support for scanning AAB with MobSF
    • Convert AAB to APK for scanning
    • Dockerfile QA
    • Prevent docker container exits on volume mount
    • Android Frida root bypass and debugger bypass scripts improvements
    • Added a new Android SAST Rule android_webview_allow_file_from_url
    • Deeplink Trigger Support for Android Dynamic Analyzer
    • Added support for real time scan status and scan logs in scan report, REST API exposed
    • Add support for numeric iOS Bundle ID
    • General Code QA
    • Dependency Bump

  • Security

    • Fixed an SSRF in firebase db check in MobSF <=3.9.7
    • Fixes a zip slip vulnerability in MobSF <= 4.0.6 affecting AR archive extraction

What's Changed

New Contributors

Full Changelog: v3.9.7...v4.0.7

Contributors

ohyeah521, miaoyc666, and 2 other contributors
Assets 2
Loading

v3.9.7 Beta

25 Mar 18:20
@ajinabraham ajinabraham
v3.9.7
6bce5a2
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v3.9.7 Beta

v3.9.7 Beta Changelog

  • Features or Enhancements

    • iOS Dynamic Analyzer with Corellium
    • Dynamic Analysis refactoring for Android and iOS
    • Exposed iOS Dynamic Analysis REST APIs
    • Added more helper Frida Scripts for Android and iOS Dynamic Analyzer
    • Frida support improvements Injected Frida Code View, Injection, Spawn, Attach and Session
    • Corellium Reverse SSH connection support
    • Enhancements to ARC and Stack Canary Checks in Mach-O Parsing
    • Frida RPC Hooks support
    • Frida Script QA
    • Runtime Executable Tampering Detection
    • iOS Dynamic Analysis REST API Docs
    • Global Datatables Export as PDF, CSV, XLS, Copy and Print
    • Corellium custom host domain support
    • Huge improvements in Static Analysis report generation page rendering for APKs/IPAs with large amount of data by @JPSxzy8
    • Scan independent library file (.so, .dylib, Framework dylib) from APK/IPA Static Analysis Report
    • Library analysis refactored relative path helper for Django template.
    • Re-introduced RELRO checks for Android, added Dart binary check to avoid Flutter false positives.
    • Improved stripped debug symbol check for ELF and MachO using native OS tools such as nm and objdump when available.
    • Merge iOS Framework and Dylib Analysis.
    • SAST Performance improvements
    • Android API Analysis rule QA
    • Apksigner.jar fallback for signature parsing
    • Simplify MobSF scan REST API
    • Support for analysis of iOS Frameworks
    • Android SVG icon parsing improvments
    • Icon analysis refactor and support jpeg and webp icons
    • Github action QA
    • iOS merge findings from swift and objective c rules with same rule identifier. Fixes #2287
    • iOS Binary analysis, sort regex matches. Fixes #2252
    • Framework dylibs with no extensions to skip PIE checks. Fixes #2307
    • Select correct network_security config. Fixes #2049
    • Android Manifest Analysis added support for detecting task hijacking (StrandHogg 1.0 and StrandHogg 2.0) . Fixes #2124
    • Added new manifest analysis rule to warn on apps targeting older Android OS
    • Updated severity of findings
    • UI improvement for AppSec dashboard to show a loader
    • UI changes in Static Analysis to collapse large no of files in API and Code Analysis for better real estate
    • Improved certificate file analysis for android, jar, aar, and iOS
    • AppLink asset json check multithreading performance improvements
    • Code QA and ruleset improvements with ChatGPT
    • Fixes #2324 , Bug in parsing DSA Public Key parameters for fingerprint calculation.
    • AssetLink check QA
    • Remove Androguard dependency use only features required by MobSF

  • Security

    • Arbitrary file writes on Windows with apktool fixed
    • Fixed an LFI reported by @0x33c0unt
    • Fixed SSRF in AppLinks and Firebase database checks

What's Changed

New Contributors

Full Changelog: v3.7.6...v3.9.7

Contributors

ohyeah521, ajinabraham, and 6 other contributors
Assets 2
Loading

v3.7.6 Beta

28 Aug 04:57
@ajinabraham ajinabraham
v3.7.6
bb700fa
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v3.7.6 Beta

v3.7.6 Beta Changelog

  • Features or Enhancements
    • Docker base image update to Ubuntu 22.04
    • Dockerfile QA
    • Migrated from Pip to Poetry for dependency management
    • Migrate from setup.py to use poetry for build and publish
    • Python 3.11 support
    • Docker ADB connection improvements (host.docker.internal translation for localhost)
    • IOS Swift RulesUpdates ios_biometric_bool, ios_biometric_acl, ios_keychain_weak_acl_device_passcode, ios_keychain_weak_accessibility_value, ios_insecure_random_no_generator, ios_biometry_hardened
    • Android SCA rules update
    • Entropies scan support for strings
    • Regex Hardening: Fixes possible Regex DoS in rules and MobSF code base
    • Tox QA
    • Added poetry build test
    • Updated mobsf PyPI publishing workflow
    • Update local DBs
    • URLs/Email extraction refactor
    • Static and Dynamic Binary Analysis QA
    • Refactor Dex permissions
    • Refactor Androguard apk.APK() usage
    • Fallback certificate analysis using apksigtool
    • Use BeautifulSoup4 to prettify malformed XML
    • Detect non standard XML namespace in AndroidManifest.xml, Fixes : #2198
    • Updated android permissions list
    • Updated android permission update check script
    • Github Actions version update
    • Apktool bump
    • Bump httptools
    • Bump yara-python-dex
    • Docker image build test for PRs
    • iOS Source Report Fix
    • Removed unwanted pinned repository
    • Frida APK Patcher (WIP)
    • Fix for Recent Scans scan not completed for iOS zip
    • Fix for MachO stripped symbols false positive
    • Fix bug in IPA download
    • iOS/Android form validation fix
    • Fix missing exported components
  • Enterprise Feature Request
    • String extraction from APK, Source, AAR, JAR, SO.
    • Android strings sections to show source of strings extracted
    • Strings extraction refactor
    • Support for independent .so scan
    • Dylib analysis support
    • Dylib string extraction
    • Improved iOS Plist secret extraction
    • Support for Independent .dylib scan
    • Symbols view for dylib and so
    • Trackers support for so
    • AAR/JAR obfuscation and debug check
    • Independent Static Library(.a) ELF/MachO Analysis
    • Mac FAT binary only supported on Mac

What's Changed

New Contributors

Full Changelog: v3.6.9...v3.7.6

Contributors

ajinabraham, Abb4d0n, and 2 other contributors
Assets 2
Loading

v3.6.9 Beta

23 Jul 19:43
@ajinabraham ajinabraham
v3.6.9
d021da6
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v3.6.9 Beta

v3.6.9 Beta Changelog

  • Features or Enhancements
    • New Simplified and Updated Documentation https://mobsf.github.io/docs/#/
    • MobSF Dynamic Analysis support for Docker image
    • Updated Documentation to include support for Corellium ARM64 Android VMs
    • Add support for environment variables to configure MobSF
    • Android SCA extract icon from SVG
    • OFAC Sanctioned Country Check
    • Improved Android Certificate Analysis
    • Updated Android Manifest Analysis Rules
    • Enterprise Feature Request
      • Summary of Findings under each section
      • Support for independent scanning of AAR ad JAR files.

What's Changed

New Contributors

Full Changelog: v3.6.0...v3.6.9

Contributors

ajinabraham, pyup-bot, and 5 other contributors
Assets 2
Loading

v3.6.0 Beta

04 Oct 04:46
@ajinabraham ajinabraham
v3.6.0
037caac
Compare
Choose a tag to compare
v3.6.0 Beta

IMPORTANT - IF YOU ARE UPDATING MOBSF

This release has database model changes. To update see: https://mobsf.github.io/docs/#/updating
This release has a breaking change. Please rescan all existing scans after the update. Perform rescan from Recent Scans view.

v3.6.0 Beta Changelog

  • Features or Enhancements

    • False Positive Triaging / Suppression Triaging Support for critical Android and iOS Security Analysis features.
      • Android Binary & Source - Supports Code Analysis and Manifest Analysis
      • iOS Binary - Supports Binary Code Analysis
      • iOS Source - Supports Code Analysis
      • New REST APIs for Suppression Support
    • Android Certificate Analysis improvements
    • Remove RELRO check from android binary analysis due to false positives
    • iOS Bundle ID extraction improvements
    • Feature parity - Allow IPA downloads from reports view
    • Code QA: Reduce False positives in identified secrets
    • Check for updates from Github releases
    • M1 Mac support
    • Disabled by default feature to support hotspots in AppSec Scorecard
    • Dependency updates
    • Added CodeQL scan on MobSF python code base

  • Bug Fixes

    • Fixes #1999, #1917, #2042 #1981 #2014 #2043
    • Fixed a bug in JSON response REST API
    • iOS URL view fix
    • Code fixes to address minor security issues in thrid party libraries.
    • Handle JADX timeouts
Assets 2
Loading

v3.5.0 Beta

23 Jan 23:08
@ajinabraham ajinabraham
v3.5.0
3c6bf4e
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v3.5.0 Beta

IMPORTANT - IF YOU ARE UPDATING MOBSF

This release has database model changes. To update see: https://mobsf.github.io/docs/#/updating
This release has a breaking change. Please rescan all existing scans after the update. Perform rescan from Recent Scans view.

v3.5.0 Beta Changelog

  • Features or Enhancements

    • MobSF Application Security Scorecard for scoring mobile application security
    • Scorecard REST API
    • Published Static Analyzer online mobsf.live (Thanks to Jovan Petrovic for sponsoring the server)
    • Improved App Security Scoring Logic
    • Improved PDF Report, Reduce generation times.
    • Disable CVSSv2 by default.
    • Non blocking file upload from home screen.
    • Android and iOS SAST rule QA
    • Manifest, Certificate, Transport Security and Network Security rule QA
    • Common severity levels High, Warning, Info and Secure.

  • Bug Fixes

    • Fixes #1885
    • Replaced PWD with dedicated server
Assets 2
Loading

v3.4.6 Beta

08 Jan 22:25
@ajinabraham ajinabraham
v3.4.6
8a7cb0a
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v3.4.6 Beta

v3.4.6 Beta Changelog

  • Features or Enhancements

    • Quark Version Update
    • New Frida Scripts from F-Secure labs
    • Manual Activity Launcher and REST API
    • Suppress warnings from third party
    • LIEF integration QA
    • Update Janus Vulnerability description
    • General Code QA
    • Improve Setup script
    • Update Dockerfile to use non-root user
    • PDF in landscape
    • Add healthcheck to dockerfile
    • Update Android API rules
    • iOS Hardcoded Secret extraction from plists
    • Add browsable activities in android diff
    • Multiplatform docker image
    • Added checks and bypass for certificate transparency
    • Updated Android Static Analysis rules
    • Improved Split APK support, now supports .apks file
    • Ability to lookup and download APK from apktada/apkpure/apkplz
    • Dynamic Analyzer: Get Runtime Application Third party dependencies
    • Persist Frida Code change in session storage
    • Show Base64 strings decoded at runtime and the called class
    • Detect Trackers from Runtime Dependencies and Network Traffic
    • Windows Binskim version pinning
    • Global Proxy Configuration for Dynamic Analyzer

  • Bug Fixes

    • Fix Django 4.0 support
    • Fix minor bugs
    • Fix dependency issues
Assets 2
Loading

v3.4.3 Beta

25 Apr 07:26
@ajinabraham ajinabraham
v3.4.3
44998d5
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v3.4.3 Beta

v3.4.3 Beta Changelog

  • Features or Enhancements

    • Android Dynamic Analysis TLS/SSL Security Tester
    • Dynamic Analysis without Static Analysis
    • Support Dynamic Analysis of third party apps in VM/AVD
    • Download and perform static analysis of third party apps from VM/AVD
    • Dynamic Analysis enhancement to preserve app config/data
    • Improved SSL Pinning Bypass script
    • Added Intent dumper auxiliary Frida script
    • Added an auxiliary method bypass template script
    • Security Hardening
    • Addressing LGTM issues and QA
    • Android Permissions Mapping update and Typo fix
    • VirusTotal Code QA
    • Refactored Logcat log viewer to show only app specific logs
    • Xposed Improvements and updates of agents
    • Updated frontend libraries for CodeMirror and EnligherJS
    • New REST API exposed for TLS/SSL tests
    • General Code QA

  • Bug Fixes

    • Fixed Windows Setup script
    • Fixed typo and incomplete description in Android permission mapping
Assets 2
Loading