Android Pentest with MobSF Guide

If you're serious about Android penetration testing, then learning how to perform automated APK analysis using MobSF (Mobile Security Framework) is essential. MobSF is one of the most powerful open-source tools for static and dynamic mobile security testing, widely used by security researchers and bug bounty hunters.
In this guide, you'll learn:

• How to install MobSF on Ubuntu
• How to analyze Android APK files
• Static vs Dynamic analysis
• Malware analysis features
• Hardcoded secrets detection
• How to generate professional security reports

⚠️ This article is for ethical hacking and security research purposes only.

What Is MobSF? 🧠​

MobSF (Mobile Security Framework) is an open-source automated mobile security testing framework developed by Ajin Abraham.
It combines multiple tools under one interface, including:

• JADX (Decompiler)
• APKTool
• Frida (Dynamic instrumentation)
• APKiD (Malware detection)
• Static code analyzers

MobSF performs:

• Static Analysis (without running the app)
• Dynamic Analysis (runtime testing)
• Malware checks
• Hardcoded secrets detection
• API monitoring

This makes it extremely valuable for Android pentesters.

---

Installing MobSF on Ubuntu 🐧​

Step 1: Clone the Repository​

git clone https://github.com/MobSF/Mobile-Security-Framework-MobSF.git
cd Mobile-Security-Framework-MobSF

Step 2: Install Dependencies​

sudo apt-get install python3-venv
pip3 install -r requirements.txt

Step 3: Run Setup Script​

./setup.sh

Step 4: Start MobSF​

./run.sh

MobSF will run locally on: http://127.0.0.1:8000
Now you can open it in your browser and start analyzing APK files.

---

MobSF Landing Page Overview 📊​

Once you upload an APK file, MobSF automatically performs static analysis.
You’ll see:

• Security severity score
• APK file hash
• File size
• Package name
• Main activity
• Minimum SDK version
• Application version

The higher the security score, the more secure the app.

---

Static Analysis Features 🔍​

Static analysis examines the APK without executing it.

1️⃣ Signer Certificate Analysis​

MobSF shows:

• Developer details
• Country and organization
• Signing algorithm
• Key size

This helps verify app authenticity.

2️⃣ Application Permissions Analysis​

MobSF categorizes permissions into:

• Dangerous
• Normal

Example dangerous permissions:

• READ_EXTERNAL_STORAGE
• WRITE_EXTERNAL_STORAGE
• READ_CONTACTS

If sensitive data is stored in external storage, it can be accessed by other apps - a major security risk.

3️⃣ Browsable Activities & Deep Links​

MobSF identifies:

• Exported activities
• Deep link schemas
• Potential intent vulnerabilities

This helps detect activity hijacking or intent injection issues.

4️⃣ Network Security Analysis 🌐​

MobSF checks for:

• SSL Pinning implementation
• Cleartext traffic
• Network configuration issues

Missing SSL pinning may lead to Man-in-the-Middle (MiTM) attacks.

5️⃣ Android Manifest Analysis​

MobSF extracts key security details from AndroidManifest.xml:

• Exported components
• Debuggable flag
• Data schemas
• Services & receivers

Example risky configuration:

android:debuggable="true"

This should never be enabled in production apps.

---

Code Analysis & OWASP Mapping 🔥​

One of MobSF’s strongest features is its code analysis engine.
It:

• Maps vulnerabilities to OWASP Top 10
• Assigns CWE IDs
• Calculates CVSS scores
• References OWASP MSTG guidelines

This makes professional reporting much easier.

---

Malware Analysis Features 🦠​

MobSF integrates multiple malware detection techniques.

APKiD Analysis​

Detects:

• Packers
• Obfuscators
• Anti-VM techniques

Similar to PEiD for Windows executables.

Domain Malware Check​

MobSF extracts:

• Hardcoded URLs
• IP addresses
• C2 servers

It also performs:

• Malware reputation checks
• IP geolocation lookup

This is crucial in malware investigation.

Strings Analysis​

MobSF extracts ASCII and Unicode strings embedded in the APK.
This may reveal:

• Hidden URLs
• Suspicious API keys
• Debug messages
• Hardcoded credentials

Example: Extracting Base64 strings for decoding.

---

Hardcoded Secrets Detection 🔑​

Many developers mistakenly store secrets inside:

• strings.xml
• Java source code

Example:

<string name="aws_secret_key">AKIAIOSFODNN7EXAMPLE</string>

MobSF can detect:

• AWS credentials
• API tokens
• Email addresses
• Database URLs

Hardcoded secrets are one of the most critical mobile security risks.

---

APK Components Enumeration 🧩​

MobSF lists:

• Activities
• Services
• Broadcast receivers
• Content providers

This gives a complete structural map of the application.
Even in obfuscated apps, MobSF may reconstruct class names.

---

Dynamic Analysis Using MobSF ⚙️​

For runtime testing, you need:

• Android VM (Genymotion recommended)
• Frida instrumentation

When dynamic analyzer is launched:

• MobSF attaches to the emulator
• Injects Frida scripts
• Monitors runtime behavior

What Can Dynamic Analysis Detect?​

• SSL Pinning bypass
• Root detection bypass
• API calls in real time
• Class enumeration
• String comparisons

This is extremely helpful for bypass testing and runtime vulnerability detection.

---

Logcat Monitoring 📜​

MobSF allows viewing device logs directly inside its interface.
This helps detect:

• Debug messages
• Sensitive data leakage
• Runtime errors

---

API Monitor 📡​

MobSF monitors API calls during runtime.
For example:
If the app uses Base64 decoding:

Base64.decode(encodedValue, Base64.DEFAULT);

You may capture decoded output during execution.
This helps uncover hidden secrets or encrypted data.

---

Generating Professional Security Reports 📝​

After completing analysis:
Click Generate Report from the sidebar.
If report generation fails, install:

sudo apt-get install wkhtmltopdf

MobSF generates:

• Static analysis report
• Dynamic analysis report
• Vulnerability summary
• Screenshots
• OWASP mappings

These reports are ideal for:

• Client pentest deliverables
• Bug bounty submissions
• Security documentation

---

Why MobSF Is Important for Android Pentesting 🚀​

MobSF helps security analysts:

• Save time
• Automate repetitive testing
• Detect hardcoded secrets
• Analyze malware behavior
• Map vulnerabilities to OWASP

While it does not replace manual testing, it significantly speeds up Android security assessments.

---

Final Thoughts 💡​

MobSF is one of the best tools for automated Android APK security analysis.
It provides:
✔ Static analysis
✔ Dynamic analysis
✔ Malware detection
✔ Hardcoded secrets discovery
✔ Professional reporting
If you want to become a professional Android penetration tester, mastering MobSF is a must.