Elvis Wiki - User contributions [en]

Mobile Application Obfuscation

2025-01-20T19:05:32Z

MKerndl:

== Summary ==

This article explores the obfuscation of mobile application from the angle of reverse-engineering protection. It introduces three different tools that are commonly used to obfuscate Android applications, compares them to each other, and thereby highlights their strengths and weaknesses. By analyzing the behavior of these tools across different applications, this article provides insight into how to balance usability and efficiency of applications, while trying to enhance security.

== Introduction to Mobile App Obfuscation ==

Mobile app obfuscation is a technique used to protect the source code of applications from reverse engineering. By obfuscating code into a form that is more difficult for attackers to understand, obfuscation helps to protect intellectual property and sensitive data. This process is particularly important in the Android development environment, since the APK format makes application much easier to decompile using tools like Jadx. With the growing threat of cybercrime, code obfuscation is becoming an essential aspect of defense, complementing encryption and secure coding practices.

== Mobile Obfuscation Tools ==
Tools play an important role in mobile application obfuscation by automating the process of transforming code into a more secure and less comprehensible form. These tools help developers to protect their applications against reverse engineering without compromising the functionality of the application. By offering several different obfuscation techniques, like identifier renaming, string encryption, and control flow obfuscation, these tools increase the overall security of mobile applications.

* R8: R8 is Google's official tool for code obfuscation in Android applications. It is directly integrated into Android Studio and focuses on optimizing application size and performance while adding minor obfuscation layers. Specifically, R8 offers weak obfuscation methods like identifier renaming and code minification, which change variable, method, and class names and remove non-functional aspects of the code (Comments, etc.) while keeping the functionality of the code intact. This complicates a static analysis, but offers no protection against dynamic analysis and reverse engineering during the app's runtime. However, it's effortless integration with the Android development ecosystem still makes it a very popular choice for developers.

* DashO: DashO is a commercial obfuscation tool. It offers advanced obfuscation techniques like string encryption, and additional anti-tampering mechanisms to protect the application from unauthorized changes. A license for DashO can be obtained at a starting price of 50$ per month. DashO offers no default Android Studio integration, but can be added to Android Studio builds through code modifications.

* Allatori:Allatori is another commercial tool that focuses on Java bytecode obfuscation, and can also be used to obfuscate Android applications. It supports several advanced obfuscation strategies and can, like DashO, be integrated into the Android Studio development process. A license for Allatori costs 290$ as one-time purchase.

== Methodology ==
=== Obfuscation process ===
The project behind this article evaluated the impact of the aforementioned obfuscation tools on the performance of mobile applications. For this purpose, the following mobile applications were selected, in order of increasing complexity:
* Markor: A small app to add personal notes.
* K9: A mobile mail-client.
* FastHub: A mobile GitHub-like client.

In the testing process, each of these apps was obfuscated using the three selected tools. For R8, the testing process was integrated into Android Studio directly. For DashO and Allatori, the APKs were processed externally using their UI and command-line integration respectively.

=== Performance Testing ===
The obfuscated APKs were tested on an Android emulator to measure several key performance indicators:
* APK size
* Build time
* Startup time
* Memory usage
To ensure consistency and hedge against outliers, each of the tests except for APK size was conducted three times, with the average of these attempts being used for the final comparison.

=== Testing Environment ===
The performance tests were conducted using the Android Profiler feature in Android Studio. The Android Profiler is an extensive tool for measuring application behavior. Within Android Profiler, the following features were used to track the selected metrics:
* Capture System Activities
* Track Memory Consumption

[[File:AndroidProfiler.png|1500px]]

This approach provided an understanding of how the selected obfuscation tools affect the performance of the applications, while at the same time highlighting the practical implications and difficulties of integrating these tools into the development process.

== Findings and Analysis ==
The evaluation of R8, DashO, and Allatori revealed their strengths and weaknesses in terms of impact on application performance. While the project successfully tested most combinations of tools and apps, four tests could not be completed due to compatibility issues with DashO and Allatori for certain applications.

=== Performance Indicators ===
Across all four chosen metrics, R8 significantly outperformed both DashO and Allatori. This makes sense, considering that R8 is focused on application optimization, as previously mentioned. DashO and Allatori had weaker test results, which can be explained by their focus on obfuscation. The additional layers of obfuscation added by these tools contributed to increasing startup times and larger APK sizes. However, they outperformed R8 in the "Memory usage" metric, which shows that they include better Resource Management in their obfuscation.

=== Usability and Integration ===
R8, per default integrated into Android Studio and the Gradle build process, makes it the by far easiest tool to use for Android app development. Its automated configuration is a notable advantage. DashO and Allatori on the other hand required additional setup, which makes them more difficult to integrate in the Android Studio development process. Additionally, both of these tools require commercial licensing, making them less accessible than R8.

Overall, the findings highlight the tradeoffs between security and performance when selecting an obfuscation tool for an application. R8 was found to be the most practical choice for developers focused on optimization and performance rather than obfuscation, while DashO and Allatori offer stronger reverse-engineering protection at the cost of worse performance and additional complexity.

== References ==
* https://github.com/skylot/jadx
* https://www.preemptive.com/blog/migrating-from-proguard-or-dexguard-to-dasho
* https://www.guardsquare.com/blog/proguard-and-r8
* https://www.preemptive.com/products/dasho/
* https://www.dash0.com/pricing
* https://allatori.com/price.html

[[Category:Documentation]]

Mobile Application Obfuscation

2025-01-15T00:36:06Z

MKerndl: Added image

== Summary ==

This article explores the obfuscation of mobile application from the angle of reverse-engineering protection. It introduces three different tools that are commonly used to obfuscate Android applications, compares them to each other, and thereby highlights their strengths and weaknesses. By analyzing the behavior of these tools across different applications, this article provides insight into how to balance usability and efficiency of applications, while trying to enhance security.

== Introduction to Mobile App Obfuscation ==

Mobile app obfuscation is a technique used to protect the source code of applications from reverse engineering. By obfuscating code into a form that is more difficult for attackers to understand, obfuscation helps to protect intellectual property and sensitive data. This process is particularly important in the Android development environment, since the APK format makes application much easier to decompile using tools like Jadx. With the growing threat of cybercrime, code obfuscation is becoming an essential aspect of defense, complementing encryption and secure coding practices.

== Mobile Obfuscation Tools ==
Tools play an important role in mobile application obfuscation by automating the process of transforming code into a more secure and less comprehensible form. These tools help developers to protect their applications against reverse engineering without compromising the functionality of the application. By offering several different obfuscation techniques, like identifier renaming, string encryption, and control flow obfuscation, these tools increase the overall security of mobile applications.

* R8: R8 is Google's official tool for code obfuscation in Android applications. It is directly integrated into Android Studio and focuses on optimizing application size and performance while adding minor obfuscation layers. Specifically, R8 offers weak obfuscation methods like identifier renaming and code minification, which change variable, method, and class names and remove non-functional aspects of the code (Comments, etc.) while keeping the functionality of the code intact. This complicates a static analysis, but offers no protection against dynamic analysis and reverse engineering during the app's runtime. However, it's effortless integration with the Android development ecosystem still makes it a very popular choice for developers.

* DashO: DashO is a commercial obfuscation tool. It offers advanced obfuscation techniques like string encryption, and additional anti-tampering mechanisms to protect the application from unauthorized changes. A license for DashO can be obtained at a starting price of 50$ per month. DashO offers no default Android Studio integration, but can be added to Android Studio builds through code modifications.

* Allatori:Allatori is another commercial tool that focuses on Java bytecode obfuscation, and can also be used to obfuscate Android applications. It supports several advanced obfuscation strategies and can, like DashO, be integrated into the Android Studio development process. A license for Allatori costs 290$ as one-time purchase.

== Methodology ==
=== Obfuscation process ===
The project behind this article aimed to evaluate the impact of the aforementioned obfuscation tools on the performance of mobile applications. For this purpose, the following mobile applications were selected, in order of increasing complexity:
* Markor: A small app to add personal notes.
* K9: A mobile mail-client.
* FastHub: A mobile GitHub-like client.

In the testing process, each of these apps was obfuscated using the three selected tools. For R8, the testing process was integrated into Android Studio directly. For DashO and Allatori, the APKs were processed externally using their UI and command-line integration respectively.

=== Performance Testing ===
The obfuscated APKs were tested on an Android emulator to measure several key performance indicators:
* APK size
* Build time
* Startup time
* Memory usage
To ensure consistency and hedge against outliers, each of the tests except for APK size was conducted three times, with the average of these attempts being used for the final comparison.

=== Testing Environment ===
The performance tests were conducted using the Android Profiler feature in Android Studio. The Android Profiler is an extensive tool for measuring application behavior. Within Android Profiler, the following features were used to track the selected metrics:
* Capture System Activities
* Track Memory Consumption

[[File:AndroidProfiler.png|1500px]]

This approach provided an understanding of how the selected obfuscation tools affect the performance of the applications, while at the same time highlighting the practical implications and difficulties of integrating these tools into the development process.

== Findings and Analysis ==
The evaluation of R8, DashO, and Allatori revealed their strengths and weaknesses in terms of impact on application performance. While the project successfully tested most combinations of tools and apps, four tests could not be completed due to compatibility issues with DashO and Allatori for certain applications.

=== Performance Indicators ===
Across all four chosen metrics, R8 significantly outperformed both DashO and Allatori. This makes sense, considering that R8 is focused on application optimization, as previously mentioned. DashO and Allatori had weaker test results, which can be explained by their focus on obfuscation. The additional layers of obfuscation added by these tools contributed to increasing startup times and larger APK sizes. However, they outperformed R8 in the "Memory usage" metric, which shows that they include better Resource Management in their obfuscation.

=== Usability and Integration ===
R8, per default integrated into Android Studio and the Gradle build process, makes it the by far easiest tool to use for Android app development. Its automated configuration is a notable advantage. DashO and Allatori on the other hand required additional setup, which makes them more difficult to integrate in the Android Studio development process. Additionally, both of these tools require commercial licensing, making them less accessible than R8.

Overall, the findings highlight the tradeoffs between security and performance when selecting an obfuscation tool for an application. R8 was found to be the most practical choice for developers focused on optimization and performance rather than obfuscation, while DashO and Allatori offer stronger reverse-engineering protection at the cost of worse performance and additional complexity.

== References ==
* https://github.com/skylot/jadx
* https://www.preemptive.com/blog/migrating-from-proguard-or-dexguard-to-dasho
* https://www.guardsquare.com/blog/proguard-and-r8
* https://www.preemptive.com/products/dasho/
* https://www.dash0.com/pricing
* https://allatori.com/price.html

[[Category:Documentation]]

File:AndroidProfiler.png

2025-01-15T00:33:35Z

MKerndl: Image of Android Profiler

== Summary ==
Image of Android Profiler

Mobile Application Obfuscation

2025-01-14T21:36:50Z

MKerndl: Added more paragraphs

== Summary ==

This article explores the obfuscation of mobile application from the angle of reverse-engineering protection. It introduces three different tools that are commonly used to obfuscate Android applications, compares them to each other, and thereby highlights their strengths and weaknesses. By analyzing the behavior of these tools across different applications, this article provides insight into how to balance usability and efficiency of applications, while trying to enhance security.

== Introduction to Mobile App Obfuscation ==

Mobile app obfuscation is a technique used to protect the source code of applications from reverse engineering. By obfuscating code into a form that is more difficult for attackers to understand, obfuscation helps to protect intellectual property and sensitive data. This process is particularly important in the Android development environment, since the APK format makes application much easier to decompile using tools like Jadx. With the growing threat of cybercrime, code obfuscation is becoming an essential aspect of defense, complementing encryption and secure coding practices.

== Mobile Obfuscation Tools ==
Tools play an important role in mobile application obfuscation by automating the process of transforming code into a more secure and less comprehensible form. These tools help developers to protect their applications against reverse engineering without compromising the functionality of the application. By offering several different obfuscation techniques, like identifier renaming, string encryption, and control flow obfuscation, these tools increase the overall security of mobile applications.

* R8: R8 is Google's official tool for code obfuscation in Android applications. It is directly integrated into Android Studio and focuses on optimizing application size and performance while adding minor obfuscation layers. Specifically, R8 offers weak obfuscation methods like identifier renaming and code minification, which change variable, method, and class names and remove non-functional aspects of the code (Comments, etc.) while keeping the functionality of the code intact. This complicates a static analysis, but offers no protection against dynamic analysis and reverse engineering during the app's runtime. However, it's effortless integration with the Android development ecosystem still makes it a very popular choice for developers.

* DashO: DashO is a commercial obfuscation tool. It offers advanced obfuscation techniques like string encryption, and additional anti-tampering mechanisms to protect the application from unauthorized changes. A license for DashO can be obtained at a starting price of 50$ per month. DashO offers no default Android Studio integration, but can be added to Android Studio builds through code modifications.

* Allatori:Allatori is another commercial tool that focuses on Java bytecode obfuscation, and can also be used to obfuscate Android applications. It supports several advanced obfuscation strategies and can, like DashO, be integrated into the Android Studio development process. A license for Allatori costs 290$ as one-time purchase.

== Methodology ==
=== Obfuscation process ===
The project behind this article aimed to evaluate the impact of the aforementioned obfuscation tools on the performance of mobile applications. For this purpose, the following mobile applications were selected, in order of increasing complexity:
* Markor: A small app to add personal notes.
* K9: A mobile mail-client.
* FastHub: A mobile GitHub-like client.

In the testing process, each of these apps was obfuscated using the three selected tools. For R8, the testing process was integrated into Android Studio directly. For DashO and Allatori, the APKs were processed externally using their UI and command-line integration respectively.

=== Performance Testing ===
The obfuscated APKs were tested on an Android emulator to measure several key performance indicators:
* APK size
* Build time
* Startup time
* Memory usage
To ensure consistency and hedge against outliers, each of the tests except for APK size was conducted three times, with the average of these attempts being used for the final comparison.

=== Testing Environment ===
The performance tests were conducted using the Android Profiler feature in Android Studio. The Android Profiler is an extensive tool for measuring application behavior. Within Android Profiler, the following features were used to track the selected metrics:
* Capture System Activities
* Track Memory Consumption

This approach provided an understanding of how the selected obfuscation tools affect the performance of the applications, while at the same time highlighting the practical implications and difficulties of integrating these tools into the development process.

== Findings and Analysis ==
The evaluation of R8, DashO, and Allatori revealed their strengths and weaknesses in terms of impact on application performance. While the project successfully tested most combinations of tools and apps, four tests could not be completed due to compatibility issues with DashO and Allatori for certain applications.

=== Performance Indicators ===
Across all four chosen metrics, R8 significantly outperformed both DashO and Allatori. This makes sense, considering that R8 is focused on application optimization, as previously mentioned. DashO and Allatori had weaker test results, which can be explained by their focus on obfuscation. The additional layers of obfuscation added by these tools contributed to increasing startup times and larger APK sizes. However, they outperformed R8 in the "Memory usage" metric, which shows that they include better Resource Management in their obfuscation.

=== Usability and Integration ===
R8, per default integrated into Android Studio and the Gradle build process, makes it the by far easiest tool to use for Android app development. Its automated configuration is a notable advantage. DashO and Allatori on the other hand required additional setup, which makes them more difficult to integrate in the Android Studio development process. Additionally, both of these tools require commercial licensing, making them less accessible than R8.

Overall, the findings highlight the tradeoffs between security and performance when selecting an obfuscation tool for an application. R8 was found to be the most practical choice for developers focused on optimization and performance rather than obfuscation, while DashO and Allatori offer stronger reverse-engineering protection at the cost of worse performance and additional complexity.

== References ==
* https://github.com/skylot/jadx
* https://www.preemptive.com/blog/migrating-from-proguard-or-dexguard-to-dasho
* https://www.guardsquare.com/blog/proguard-and-r8
* https://www.preemptive.com/products/dasho/
* https://www.dash0.com/pricing
* https://allatori.com/price.html

[[Category:Documentation]]

Mobile Application Obfuscation

2025-01-14T21:11:52Z

MKerndl: Added References

Mobile Application Obfuscation

2025-01-14T21:08:59Z

MKerndl: Added first paragraphs

Potato Vulnerabilities

2024-12-19T01:13:07Z

MKerndl: Expanded on the Overview

== Summary ==
This article explores the family of Potato Vulnerabilities, a group of privilege escalation exploits targeting Windows operating systems. These vulnerabilities exploit weaknesses in token handling, impersonation privileges, and authentication protocols, using techniques like NTLM reflection and token manipulation. This article provides an overview of the vulnerabilities, explains the exploitation techniques used, details specific vulnerabilities within the Potato family, and discusses mitigation strategies to defend against these attacks.

== Overview of Potato Vulnerabilities ==
Potato Vulnerabilities are a family of privilege escalation exploits that utilize token-based weaknesses in Windows operating systems. These vulnerabilities make it possible for attackers to elevate privileges from low-level user accounts to high-privilege accounts, for example system or administrator accounts. First introduced in 2016 with the "Hot Potato" exploit by Stephen Breen, the Potato Vulnerabilities have continually evolved, including new techniques to bypass Microsoft's security updates and mitigations. They commonly target flaws in Windows authentication protocols, such as NTLM and misconfigured token handling.
Over time, these vulnerabilities have demonstrated their adaptability with new variants, using new and different weaknesses in Windows security mechanisms. This family of vulnerabilities remains important in cybersecurity because of its effectiveness, easy usability, and the continued discovery of previously unknown variations.

== Exploitation Techniques ==
Potato Vulnerabilities utilize advanced exploitation techniques to achieve privilege escalation. The most important methods are:

* Token Manipulation: Token manipulation is an essential part of privilege escalation attacks within Windows systems. Access tokens in Windows represent the security identity of a process, most notably including user privileges and group memberships. By exploiting vulnerabilities in the generation and management processes of these tokens, attackers can impersonate tokens belonging to higher-privileged accounts. This allows them to execute actions with administrative or system-level privileges, bypassing security restrictions. For example, in vulnerabilities like Juicy Potato, attackers exploit the SeImpersonatePrivilege to craft and impersonate tokens. This allows them to execute code with elevated permissions. Such attacks are particularly effective against misconfigured service accounts that operate with unnecessarily high privileges.
* NTLM Reflection: NTLM Reflection attacks exploit weaknesses in the NT LAN Manager (NTLM) authentication protocol, which is often used in Windows systems. In these attacks, the victim is tricked into authenticating with a malicious server controlled by the attacker. During this process, the attacker captures the victim's credentials and "reflects" the authentication attempt back to the victim or another target. By using these stolen credentials, the attacker can impersonate the victim and gain access to their privileged resources. Potato vulnerabilities, such as Hot Potato and Ghost Potato, heavily rely on NTLM Reflection to bypass authentication protocols and elevate privileges. These attacks are particularly dangerous because they exploit Windows services that are often trusted by the operating system, making them very effective at evading detection.
* RPC/DCOM Exploitation: Misusing Windows services and protocols, such as Distributed Component Object Model (DCOM), to interact with privileged services and gain elevated access.
* Resource-Based Constrained Delegation (RBCD): Exploiting delegation settings in Active Directory to gain unauthorized access through ticket manipulation.

== Specific Potato Vulnerabilities ==
* Hot Potato: The first Potato vulnerability, introduced in 2016 by Stephen Breen, exploited NetBIOS Name Service (NBNS) spoofing and NTLM reflection to escalate privileges to the system level. It has been patched under CVE-2016-3213.

* Rotten Potato: An evolution of Hot Potato disclosed in 2016, it uses NTLM reflection to trick the "NT Authority\System" account into authenticating to an attacker-controlled endpoint. It has been patched in Windows 10 1809 and later versions.

* Lonely Potato: A variant of Rotten Potato, it replaced meterpreter with API calls for token impersonation, simplifying the process. Released in 2017, it is now deprecated on the same patched versions as Rotten Potato.

* Juicy Potato: Introduced in 2018, this exploit improved upon Rotten Potato by allowing the attacker to specify the CLSID for targeting, enabling greater flexibility. It was patched in Windows 10 1809.

* Ghost Potato: Disclosed in 2019, it bypasses the patched NTLM reflection protections by exploiting the Local Security Authority Subsystem Service (LSASS). It works by delaying NTLM reflection until cached challenges expire. This vulnerability was patched under CVE-2019-1384.

* Sweet Potato: Released in 2020, it is a C# version of Juicy Potato that also targets WinRM services for privilege escalation. It remains unpatched and works on Windows 7 through Windows 10 and Server 2019.

* Rogue Potato: This 2020 vulnerability uses a forged Object Exporter Identifier (OXID) response to trigger privileged authentication to an attacker-controlled listener. It remains unpatched by Microsoft.

* Generic Potato: A 2021 tool that allows users to craft their own exploits based on the Potato family techniques. It uses HTTP and named pipe listeners to exploit NTLM authentication. It is primarily used for Capture The Flag (CTF) activities and remains unpatched.

* Remote Potato: Released in 2021, this exploit uses a cross-protocol relay from RPC to LDAP or HTTP. It bypasses impersonation privileges required by earlier variants. Microsoft patched it in October 2022.

* Juicy Potato NG: A 2022 update of Juicy Potato that bypasses patched CLSIDs using a Kerberos DCOM authentication trick. It remains unpatched and continues to function.

* Cert Potato: Introduced in 2022, it abuses Active Directory Certificate Services (ADCS) to obtain a machine’s Ticket Granting Ticket (TGT) and create a Silver Ticket for domain-level privileges. It remains unpatched.

* Local Potato: Released in 2023, it targets LSASS and swaps NTLM messages to authenticate as a privileged user. It was patched under CVE-2023-21746.

* Coerced Potato: The most recent vulnerability, disclosed in 2023, enhances PrintSpoofer with new RPC call exploits, enabling privilege escalation to the system level. It remains effective on current Windows versions, including Windows 10, 11, and Server 2022.

== Mitigation ==
Mitigating Potato Vulnerabilities requires both vendor updates as well as some security practices:

* Microsoft Security Updates: Regularly apply patches and updates provided by Microsoft to address known vulnerabilities.
* Access Controls: Implement the principle of least privilege to restrict unnecessary elevated permissions.
* Network Monitoring: Use logging and monitoring tools to detect privilege escalation attacks or unauthorized authentication events.
* Patch Management: Make sure that all systems are updated to the latest versions, to decrease the likelihood of being vulnerable to Potato exploits.

These measures enhance system defenses not only against privilege escalation, but also against most other attacks and therefore reduce the impact and threat of Potato Vulnerabilities.

== References ==

* https://jlajara.gitlab.io/Potatoes_Windows_Privesc
* https://foxglovesecurity.com/2016/01/16/hot-potato/
* https://foxglovesecurity.com/2016/09/26/rotten-potato-privilege-escalation-from-service-accounts-to-system/
* https://hideandsec.sh/books/windows-sNL/page/in-the-potato-family-i-want-them-all
* https://decoder.cloud/2017/12/23/the-lonely-potato/
* http://ohpe.it/juicy-potato/
* https://shenaniganslabs.io/2019/11/12/Ghost-Potato.html
* https://www.pentestpartners.com/security-blog/sweetpotato-service-to-system/
* https://decoder.cloud/2020/05/11/no-more-juicypotato-old-story-welcome-roguepotato/
* https://micahvandeusen.com/the-power-of-seimpersonation/
* https://www.sentinelone.com/labs/relaying-potatoes-another-unexpected-privilege-escalation-vulnerability-in-windows-rpc-protocol/
* https://decoder.cloud/2022/09/21/giving-juicypotato-a-second-chance-juicypotatong/
* https://sensepost.com/blog/2022/certpotato-using-adcs-to-privesc-from-virtual-and-network-service-accounts-to-local-system/
* https://decoder.cloud/2023/02/13/localpotato-when-swapping-the-context-leads-you-to-system/
* https://blog.hackvens.fr/articles/CoercedPotato.html
* https://purplesec.us/learn/privilege-escalation-attacks/

[[Category:Pentesting]]

Potato Vulnerabilities

2024-12-19T01:09:06Z

MKerndl: Expanded on Exploitation

== Summary ==
This article explores the family of Potato Vulnerabilities, a group of privilege escalation exploits targeting Windows operating systems. These vulnerabilities exploit weaknesses in token handling, impersonation privileges, and authentication protocols, using techniques like NTLM reflection and token manipulation. This article provides an overview of the vulnerabilities, explains the exploitation techniques used, details specific vulnerabilities within the Potato family, and discusses mitigation strategies to defend against these attacks.

== Overview of Potato Vulnerabilities ==
Potato Vulnerabilities are a family of exploits that target token-based weaknesses in Windows operating systems, allowing attackers to escalate privileges from low-level user accounts to high-privilege system accounts. First introduced in 2016 with "Hot Potato" by Stephen Breen, these vulnerabilities have evolved to bypass various security measures implemented by Microsoft. They exploit Windows authentication mechanisms, misconfigured permissions and handling of tokens and delegation protocols. Several of these vulnerabilities remain important in cybersecurity due to their adaptability and continued discovery of new variants.

== Exploitation Techniques ==
Potato Vulnerabilities utilize advanced exploitation techniques to achieve privilege escalation. The most important methods are:

* Token Manipulation: Token manipulation is an essential part of privilege escalation attacks within Windows systems. Access tokens in Windows represent the security identity of a process, most notably including user privileges and group memberships. By exploiting vulnerabilities in the generation and management processes of these tokens, attackers can impersonate tokens belonging to higher-privileged accounts. This allows them to execute actions with administrative or system-level privileges, bypassing security restrictions. For example, in vulnerabilities like Juicy Potato, attackers exploit the SeImpersonatePrivilege to craft and impersonate tokens. This allows them to execute code with elevated permissions. Such attacks are particularly effective against misconfigured service accounts that operate with unnecessarily high privileges.
* NTLM Reflection: NTLM Reflection attacks exploit weaknesses in the NT LAN Manager (NTLM) authentication protocol, which is often used in Windows systems. In these attacks, the victim is tricked into authenticating with a malicious server controlled by the attacker. During this process, the attacker captures the victim's credentials and "reflects" the authentication attempt back to the victim or another target. By using these stolen credentials, the attacker can impersonate the victim and gain access to their privileged resources. Potato vulnerabilities, such as Hot Potato and Ghost Potato, heavily rely on NTLM Reflection to bypass authentication protocols and elevate privileges. These attacks are particularly dangerous because they exploit Windows services that are often trusted by the operating system, making them very effective at evading detection.
* RPC/DCOM Exploitation: Misusing Windows services and protocols, such as Distributed Component Object Model (DCOM), to interact with privileged services and gain elevated access.
* Resource-Based Constrained Delegation (RBCD): Exploiting delegation settings in Active Directory to gain unauthorized access through ticket manipulation.

== Specific Potato Vulnerabilities ==
* Hot Potato: The first Potato vulnerability, introduced in 2016 by Stephen Breen, exploited NetBIOS Name Service (NBNS) spoofing and NTLM reflection to escalate privileges to the system level. It has been patched under CVE-2016-3213.

* Rotten Potato: An evolution of Hot Potato disclosed in 2016, it uses NTLM reflection to trick the "NT Authority\System" account into authenticating to an attacker-controlled endpoint. It has been patched in Windows 10 1809 and later versions.

* Lonely Potato: A variant of Rotten Potato, it replaced meterpreter with API calls for token impersonation, simplifying the process. Released in 2017, it is now deprecated on the same patched versions as Rotten Potato.

* Juicy Potato: Introduced in 2018, this exploit improved upon Rotten Potato by allowing the attacker to specify the CLSID for targeting, enabling greater flexibility. It was patched in Windows 10 1809.

* Ghost Potato: Disclosed in 2019, it bypasses the patched NTLM reflection protections by exploiting the Local Security Authority Subsystem Service (LSASS). It works by delaying NTLM reflection until cached challenges expire. This vulnerability was patched under CVE-2019-1384.

* Sweet Potato: Released in 2020, it is a C# version of Juicy Potato that also targets WinRM services for privilege escalation. It remains unpatched and works on Windows 7 through Windows 10 and Server 2019.

* Rogue Potato: This 2020 vulnerability uses a forged Object Exporter Identifier (OXID) response to trigger privileged authentication to an attacker-controlled listener. It remains unpatched by Microsoft.

* Generic Potato: A 2021 tool that allows users to craft their own exploits based on the Potato family techniques. It uses HTTP and named pipe listeners to exploit NTLM authentication. It is primarily used for Capture The Flag (CTF) activities and remains unpatched.

* Remote Potato: Released in 2021, this exploit uses a cross-protocol relay from RPC to LDAP or HTTP. It bypasses impersonation privileges required by earlier variants. Microsoft patched it in October 2022.

* Juicy Potato NG: A 2022 update of Juicy Potato that bypasses patched CLSIDs using a Kerberos DCOM authentication trick. It remains unpatched and continues to function.

* Cert Potato: Introduced in 2022, it abuses Active Directory Certificate Services (ADCS) to obtain a machine’s Ticket Granting Ticket (TGT) and create a Silver Ticket for domain-level privileges. It remains unpatched.

* Local Potato: Released in 2023, it targets LSASS and swaps NTLM messages to authenticate as a privileged user. It was patched under CVE-2023-21746.

* Coerced Potato: The most recent vulnerability, disclosed in 2023, enhances PrintSpoofer with new RPC call exploits, enabling privilege escalation to the system level. It remains effective on current Windows versions, including Windows 10, 11, and Server 2022.

== Mitigation ==
Mitigating Potato Vulnerabilities requires both vendor updates as well as some security practices:

* Microsoft Security Updates: Regularly apply patches and updates provided by Microsoft to address known vulnerabilities.
* Access Controls: Implement the principle of least privilege to restrict unnecessary elevated permissions.
* Network Monitoring: Use logging and monitoring tools to detect privilege escalation attacks or unauthorized authentication events.
* Patch Management: Make sure that all systems are updated to the latest versions, to decrease the likelihood of being vulnerable to Potato exploits.

These measures enhance system defenses not only against privilege escalation, but also against most other attacks and therefore reduce the impact and threat of Potato Vulnerabilities.

== References ==

* https://jlajara.gitlab.io/Potatoes_Windows_Privesc
* https://foxglovesecurity.com/2016/01/16/hot-potato/
* https://foxglovesecurity.com/2016/09/26/rotten-potato-privilege-escalation-from-service-accounts-to-system/
* https://hideandsec.sh/books/windows-sNL/page/in-the-potato-family-i-want-them-all
* https://decoder.cloud/2017/12/23/the-lonely-potato/
* http://ohpe.it/juicy-potato/
* https://shenaniganslabs.io/2019/11/12/Ghost-Potato.html
* https://www.pentestpartners.com/security-blog/sweetpotato-service-to-system/
* https://decoder.cloud/2020/05/11/no-more-juicypotato-old-story-welcome-roguepotato/
* https://micahvandeusen.com/the-power-of-seimpersonation/
* https://www.sentinelone.com/labs/relaying-potatoes-another-unexpected-privilege-escalation-vulnerability-in-windows-rpc-protocol/
* https://decoder.cloud/2022/09/21/giving-juicypotato-a-second-chance-juicypotatong/
* https://sensepost.com/blog/2022/certpotato-using-adcs-to-privesc-from-virtual-and-network-service-accounts-to-local-system/
* https://decoder.cloud/2023/02/13/localpotato-when-swapping-the-context-leads-you-to-system/
* https://blog.hackvens.fr/articles/CoercedPotato.html
* https://purplesec.us/learn/privilege-escalation-attacks/

[[Category:Pentesting]]

Potato Vulnerabilities

2024-12-18T17:33:00Z

MKerndl: Main page content

== Summary ==
This article explores the family of Potato Vulnerabilities, a group of privilege escalation exploits targeting Windows operating systems. These vulnerabilities exploit weaknesses in token handling, impersonation privileges, and authentication protocols, using techniques like NTLM reflection and token manipulation. This article provides an overview of the vulnerabilities, explains the exploitation techniques used, details specific vulnerabilities within the Potato family, and discusses mitigation strategies to defend against these attacks.

== Overview of Potato Vulnerabilities ==
Potato Vulnerabilities are a family of exploits that target token-based weaknesses in Windows operating systems, allowing attackers to escalate privileges from low-level user accounts to high-privilege system accounts. First introduced in 2016 with "Hot Potato" by Stephen Breen, these vulnerabilities have evolved to bypass various security measures implemented by Microsoft. They exploit Windows authentication mechanisms, misconfigured permissions and handling of tokens and delegation protocols. Several of these vulnerabilities remain important in cybersecurity due to their adaptability and continued discovery of new variants.

== Exploitation Techniques ==
Potato Vulnerabilities utilize advanced exploitation techniques to achieve privilege escalation. The most important methods are:

* Token Manipulation: Exploiting Windows access tokens to impersonate higher-privilege users and execute actions with admin-level user accounts.
* NTLM Reflection: Redirecting authentication requests to malicious servers to capture credentials and impersonate users.
* RPC/DCOM Exploitation: Misusing Windows services and protocols, such as Distributed Component Object Model (DCOM), to interact with privileged services and gain elevated access.
* Resource-Based Constrained Delegation (RBCD): Exploiting delegation settings in Active Directory to gain unauthorized access through ticket manipulation.

== Specific Potato Vulnerabilities ==
* Hot Potato: The first Potato vulnerability, introduced in 2016 by Stephen Breen, exploited NetBIOS Name Service (NBNS) spoofing and NTLM reflection to escalate privileges to the system level. It has been patched under CVE-2016-3213.

* Rotten Potato: An evolution of Hot Potato disclosed in 2016, it uses NTLM reflection to trick the "NT Authority\System" account into authenticating to an attacker-controlled endpoint. It has been patched in Windows 10 1809 and later versions.

* Lonely Potato: A variant of Rotten Potato, it replaced meterpreter with API calls for token impersonation, simplifying the process. Released in 2017, it is now deprecated on the same patched versions as Rotten Potato.

* Juicy Potato: Introduced in 2018, this exploit improved upon Rotten Potato by allowing the attacker to specify the CLSID for targeting, enabling greater flexibility. It was patched in Windows 10 1809.

* Ghost Potato: Disclosed in 2019, it bypasses the patched NTLM reflection protections by exploiting the Local Security Authority Subsystem Service (LSASS). It works by delaying NTLM reflection until cached challenges expire. This vulnerability was patched under CVE-2019-1384.

* Sweet Potato: Released in 2020, it is a C# version of Juicy Potato that also targets WinRM services for privilege escalation. It remains unpatched and works on Windows 7 through Windows 10 and Server 2019.

* Rogue Potato: This 2020 vulnerability uses a forged Object Exporter Identifier (OXID) response to trigger privileged authentication to an attacker-controlled listener. It remains unpatched by Microsoft.

* Generic Potato: A 2021 tool that allows users to craft their own exploits based on the Potato family techniques. It uses HTTP and named pipe listeners to exploit NTLM authentication. It is primarily used for Capture The Flag (CTF) activities and remains unpatched.

* Remote Potato: Released in 2021, this exploit uses a cross-protocol relay from RPC to LDAP or HTTP. It bypasses impersonation privileges required by earlier variants. Microsoft patched it in October 2022.

* Juicy Potato NG: A 2022 update of Juicy Potato that bypasses patched CLSIDs using a Kerberos DCOM authentication trick. It remains unpatched and continues to function.

* Cert Potato: Introduced in 2022, it abuses Active Directory Certificate Services (ADCS) to obtain a machine’s Ticket Granting Ticket (TGT) and create a Silver Ticket for domain-level privileges. It remains unpatched.

* Local Potato: Released in 2023, it targets LSASS and swaps NTLM messages to authenticate as a privileged user. It was patched under CVE-2023-21746.

* Coerced Potato: The most recent vulnerability, disclosed in 2023, enhances PrintSpoofer with new RPC call exploits, enabling privilege escalation to the system level. It remains effective on current Windows versions, including Windows 10, 11, and Server 2022.

== Mitigation ==
Mitigating Potato Vulnerabilities requires both vendor updates as well as some security practices:

* Microsoft Security Updates: Regularly apply patches and updates provided by Microsoft to address known vulnerabilities.
* Access Controls: Implement the principle of least privilege to restrict unnecessary elevated permissions.
* Network Monitoring: Use logging and monitoring tools to detect privilege escalation attacks or unauthorized authentication events.
* Patch Management: Make sure that all systems are updated to the latest versions, to decrease the likelihood of being vulnerable to Potato exploits.

These measures enhance system defenses not only against privilege escalation, but also against most other attacks and therefore reduce the impact and threat of Potato Vulnerabilities.

== References ==

* https://jlajara.gitlab.io/Potatoes_Windows_Privesc
* https://foxglovesecurity.com/2016/01/16/hot-potato/
* https://foxglovesecurity.com/2016/09/26/rotten-potato-privilege-escalation-from-service-accounts-to-system/
* https://hideandsec.sh/books/windows-sNL/page/in-the-potato-family-i-want-them-all
* https://decoder.cloud/2017/12/23/the-lonely-potato/
* http://ohpe.it/juicy-potato/
* https://shenaniganslabs.io/2019/11/12/Ghost-Potato.html
* https://www.pentestpartners.com/security-blog/sweetpotato-service-to-system/
* https://decoder.cloud/2020/05/11/no-more-juicypotato-old-story-welcome-roguepotato/
* https://micahvandeusen.com/the-power-of-seimpersonation/
* https://www.sentinelone.com/labs/relaying-potatoes-another-unexpected-privilege-escalation-vulnerability-in-windows-rpc-protocol/
* https://decoder.cloud/2022/09/21/giving-juicypotato-a-second-chance-juicypotatong/
* https://sensepost.com/blog/2022/certpotato-using-adcs-to-privesc-from-virtual-and-network-service-accounts-to-local-system/
* https://decoder.cloud/2023/02/13/localpotato-when-swapping-the-context-leads-you-to-system/
* https://blog.hackvens.fr/articles/CoercedPotato.html
* https://purplesec.us/learn/privilege-escalation-attacks/

[[Category:Pentesting]]

Potato Vulnerabilities

2024-12-18T17:11:37Z

MKerndl: Added references

== Summary ==
This article explores the family of Potato Vulnerabilities

== Overview of Potato Vulnerabilities ==

== Exploitation Techniques ==

== Specific Potato Vulnerabilities ==

== Mitigation ==

== References ==

* https://jlajara.gitlab.io/Potatoes_Windows_Privesc
* https://foxglovesecurity.com/2016/01/16/hot-potato/
* https://foxglovesecurity.com/2016/09/26/rotten-potato-privilege-escalation-from-service-accounts-to-system/
* https://hideandsec.sh/books/windows-sNL/page/in-the-potato-family-i-want-them-all
* https://decoder.cloud/2017/12/23/the-lonely-potato/
* http://ohpe.it/juicy-potato/
* https://shenaniganslabs.io/2019/11/12/Ghost-Potato.html
* https://www.pentestpartners.com/security-blog/sweetpotato-service-to-system/
* https://decoder.cloud/2020/05/11/no-more-juicypotato-old-story-welcome-roguepotato/
* https://micahvandeusen.com/the-power-of-seimpersonation/
* https://www.sentinelone.com/labs/relaying-potatoes-another-unexpected-privilege-escalation-vulnerability-in-windows-rpc-protocol/
* https://decoder.cloud/2022/09/21/giving-juicypotato-a-second-chance-juicypotatong/
* https://sensepost.com/blog/2022/certpotato-using-adcs-to-privesc-from-virtual-and-network-service-accounts-to-local-system/
* https://decoder.cloud/2023/02/13/localpotato-when-swapping-the-context-leads-you-to-system/
* https://blog.hackvens.fr/articles/CoercedPotato.html
* https://purplesec.us/learn/privilege-escalation-attacks/

[[Category:Pentesting]]

Potato Vulnerabilities

2024-12-18T16:49:43Z

MKerndl: Category add

New page, will get content soon

[[Category:Pentesting]]

Potato Vulnerabilities

2024-12-18T16:48:48Z

MKerndl: Created page with "New page, will get content soon"

New page, will get content soon

Mobile Security: Automation of APK Analysis with MobSF

2024-06-21T14:23:11Z

MKerndl: /* Example Code */

== Summary ==

This article explores the automation of the Mobile Security Framework MobSF using its API, highlighting key features of the automation of static analysis for mobile applications. It discusses the API endpoints available in MobSF and shows how they can be integrated into scripts. Practical use cases are being presented, to demostrate how MobSF automation enhances mobile seucurity during the development lifecycle of a mobile application.

== Mobile Security Framework ==

Mobile Security Framework (MobSF) is a mobile application pentesting tool, capable of performing static as well as dynamic analyses. It is well known for its ability to analyze APK files for Android applications and IPA files for IOS applications. It provides detailed security assessments and vulnerability reports. MobSF supports a lot of different functionalities, including code analysis, binary analysis and runtime behavior analysis, therefore making it an important tool for mobile application security testing.

== Automation of static analysis ==

Static analysis in MobSF can be automated by implementing one of the numerous different API endpoints, which offer a wide range of functionalities.

=== Upload a File ===

* Function: API to upload a file. Supported file types are apk, zip, ipa and appx.
* URL: /api/v1/upload
* Sample Call:
curl -F 'file=@/Users/YourUser/Desktop/base.apk' http://localhost:8000/api/v1/upload -H "Authorization:YourAPIKey"

=== Scan a File ===

* Function: API to scan a file that is already uploaded. Supports scanning apk, xapk, apks, jar, aar, zip, ipa, so, dylib, a, and appx extensions.
* URL: /api/v1/scan
* Sample Call:
curl -F 'file=@/Users/YourUser/Desktop/base.apk' http://localhost:8000/api/v1/scan -H "Authorization:YourAPIKey"

=== Display Recent Scans ===

* Function: API to display recent scans.
* URL: /api/v1/scans
* Sample Call:
curl --url "http://localhost:8000/api/v1/scans" -H "Authorization:YourAPIKey"

=== Delete a Scan ===

* Function: API to scan a file that is already uploaded. Supports scanning apk, xapk, apks, jar, aar, zip, ipa, so, dylib, a, and appx extensions.
* URL: /api/v1/scan
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/delete_scan --data "hash=HashOfAPK" -H "Authorization:YourAPIKey"

=== App Scorecard ===

* Function: Get MobSF Application Security Scorecard.
* URL: /api/v1/scorecard
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/scorecard --data "hash=HashOfAPK" -H "Authorization:YourAPIKey"

=== Download PDF Report ===

* Function: API to generate PDF report.
* URL: /api/v1/download_pdf
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/download_pdf --data "hash=HashOfAPK" -H "Authorization:YourAPIKey"

=== Generate JSON Report ===

* Function: API to generate JSON report.
* URL: /api/v1/report_json
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/report_json --data "hash=HashOfAPK" -H "Authorization:YourAPIKey"

=== View Source Files ===

* Function: API to view source files.
* URL: /api/v1/view_source
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/view_source --data "hash=HashOfAPK&type=apk&file=b/a/a/a/a/a.java" -H "Authorization:YourAPIKey"

=== Compare Apps ===

* Function: API to compare scan results.
* URL: /api/v1/compare
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/compare --data "hash=HashOfAPK&hash2=HashOfOtherAPK" -H "Authorization:YourAPIKey"

=== Suppress by Rule ===

* Function: Suppress findings by rule id.
* URL: /api/v1/suppress_by_rule
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/suppress_by_rule --data "hash=HashOfAPK&type=manifest&rule=RuleYouWantToSuppress" -H "Authorization:YourAPIKey"

=== Suppress by Files ===

* Function: Suppress findings by files.
* URL: /api/v1/suppress_by_files
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/suppress_by_files --data "hash=HashOfAPK&type=code&rule=RuleYouWantToSuppress" -H "Authorization:YourAPIKey"

=== List Suppressions ===

* Function: View suppressions associated with a scan.
* URL: /api/v1/list_suppressions
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/list_suppressions --data "hash=HashOfAPK" -H "Authorization:YourAPIKey"

=== Delete Suppressions ===

* Function: Delete suppressions.
* URL: /api/v1/delete_suppression
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/list_suppressions --data "hash=HashOfAPK&kind=file&type=code&rule=RuleYouSuppressed" -H "Authorization:YourAPIKey"

== Use Cases ==

=== CI/CD Integration ===

* Description: Automatically analyize mobile applications during the build process, in order to catch security issues before application deployment.
* Implementation: Include MobSF API calls into the CI/CD pipeline to carry out scans automatically. Retrieve and parse the reults to determine if the build passes all required security criteria.
* Benefits: Every build is checked for scurity flaws, therefore reducing the risk of deploying vulnerable applications.

=== Scheduled Scans ===

* Description: Perform regular security scans on mobile applications to ensure they remain secure over time after deployment.
* Implementation: Set up cron jobs or scheduled tasks that use the MobSF API to scan at regular intervals. Collect and review the reports to see if new vulnerabilities apper.
* Benefits: Maintains security assessment over time, helping to detect and mitigate vulnerabilities introduced with updates or changes in the threat landscape.

=== Bulk analysis ===

* Description: Automate the analysis of multiple applications.
* Implementation: Develop scripts that use the MobSF API to queue and process multiple applications at once, collecting and comparing the results.
* Benefits: Manages the security assessment of portfolios of applications, making sure all of them are constantly evaluated and remain secure.

== Example Code ==

This is a simple example of automation of static Analysis in MobSF. It uploads a file, scans this file, and locally creates a pdf report of the static analysis of the APK.
<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Important</b>: Make sure to input your API Key and the URL to your MobSF instance before using the script.</div>

import sys
import os
import json
import requests
from requests_toolbelt.multipart.encoder import MultipartEncoder
# -----------------
SERVER = "Put the URL to your MobSF instance here, like http://127.0.0.1:8000"
APIKEY = 'Put your API Key here'
# -----------------
def upload(file_path):
"""Upload File"""
print("Uploading file:", file_path)
multipart_data = MultipartEncoder(fields={'file': (os.path.basename(file_path), open(file_path, 'rb'), 'application/octet-stream')})
headers = {
'Content-Type': multipart_data.content_type,
'Authorization': APIKEY
}
print("Headers for upload:", headers) # Debugging line to check headers
response = requests.post(SERVER + '/api/v1/upload', data=multipart_data, headers=headers)
print("Upload response:", response.text)
return response.json()
# -----------------
def scan(upload_response):
"""Scan the file"""
print("Scanning file")
post_dict = {'hash': upload_response['hash']}
headers = {'Authorization': APIKEY}
response = requests.post(SERVER + '/api/v1/scan', data=post_dict, headers=headers)
print("Scan response:", response.text)
return upload_response['hash']
# -----------------
def pdf(file_hash):
"""Generate PDF Report"""
print("Generate PDF report")
headers = {'Authorization': APIKEY}
data = {"hash": file_hash}
response = requests.post(SERVER + '/api/v1/download_pdf', data=data, headers=headers, stream=True)
with open("report.pdf", 'wb') as flip:
for chunk in response.iter_content(chunk_size=1024):
if chunk:
flip.write(chunk)
print("Report saved as report.pdf")
# -----------------
if __name__ == "__main__":
if len(sys.argv) != 2:
print("Usage: python script_name.py <apk_file>")
sys.exit(1)
apk_file_path = sys.argv[1]
# -----------------
if not os.path.isfile(apk_file_path) or not apk_file_path.endswith(".apk"):
print("Invalid APK file:", apk_file_path)
sys.exit(1)
upload_response = upload(apk_file_path)
# -----------------
if 'hash' not in upload_response:
print("Failed to upload the APK file. Response:", upload_response)
sys.exit(1)
# -----------------
file_hash = scan(upload_response)
pdf(file_hash)

The script can be executed as follows:

python "ScriptName" "PathToAPK"

== References ==

* https://mobsf.live/api_docs
* https://github.com/MobSF/Mobile-Security-Framework-MobSF

[[Category:Documentation]]
[[Category:Pentesting]]

Mobile Security: Automation of APK Analysis with MobSF

2024-06-21T14:22:39Z

MKerndl: /* Example Code */

== Summary ==

This article explores the automation of the Mobile Security Framework MobSF using its API, highlighting key features of the automation of static analysis for mobile applications. It discusses the API endpoints available in MobSF and shows how they can be integrated into scripts. Practical use cases are being presented, to demostrate how MobSF automation enhances mobile seucurity during the development lifecycle of a mobile application.

== Mobile Security Framework ==

Mobile Security Framework (MobSF) is a mobile application pentesting tool, capable of performing static as well as dynamic analyses. It is well known for its ability to analyze APK files for Android applications and IPA files for IOS applications. It provides detailed security assessments and vulnerability reports. MobSF supports a lot of different functionalities, including code analysis, binary analysis and runtime behavior analysis, therefore making it an important tool for mobile application security testing.

== Automation of static analysis ==

Static analysis in MobSF can be automated by implementing one of the numerous different API endpoints, which offer a wide range of functionalities.

=== Upload a File ===

* Function: API to upload a file. Supported file types are apk, zip, ipa and appx.
* URL: /api/v1/upload
* Sample Call:
curl -F 'file=@/Users/YourUser/Desktop/base.apk' http://localhost:8000/api/v1/upload -H "Authorization:YourAPIKey"

=== Scan a File ===

* Function: API to scan a file that is already uploaded. Supports scanning apk, xapk, apks, jar, aar, zip, ipa, so, dylib, a, and appx extensions.
* URL: /api/v1/scan
* Sample Call:
curl -F 'file=@/Users/YourUser/Desktop/base.apk' http://localhost:8000/api/v1/scan -H "Authorization:YourAPIKey"

=== Display Recent Scans ===

* Function: API to display recent scans.
* URL: /api/v1/scans
* Sample Call:
curl --url "http://localhost:8000/api/v1/scans" -H "Authorization:YourAPIKey"

=== Delete a Scan ===

* Function: API to scan a file that is already uploaded. Supports scanning apk, xapk, apks, jar, aar, zip, ipa, so, dylib, a, and appx extensions.
* URL: /api/v1/scan
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/delete_scan --data "hash=HashOfAPK" -H "Authorization:YourAPIKey"

=== App Scorecard ===

* Function: Get MobSF Application Security Scorecard.
* URL: /api/v1/scorecard
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/scorecard --data "hash=HashOfAPK" -H "Authorization:YourAPIKey"

=== Download PDF Report ===

* Function: API to generate PDF report.
* URL: /api/v1/download_pdf
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/download_pdf --data "hash=HashOfAPK" -H "Authorization:YourAPIKey"

=== Generate JSON Report ===

* Function: API to generate JSON report.
* URL: /api/v1/report_json
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/report_json --data "hash=HashOfAPK" -H "Authorization:YourAPIKey"

=== View Source Files ===

* Function: API to view source files.
* URL: /api/v1/view_source
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/view_source --data "hash=HashOfAPK&type=apk&file=b/a/a/a/a/a.java" -H "Authorization:YourAPIKey"

=== Compare Apps ===

* Function: API to compare scan results.
* URL: /api/v1/compare
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/compare --data "hash=HashOfAPK&hash2=HashOfOtherAPK" -H "Authorization:YourAPIKey"

=== Suppress by Rule ===

* Function: Suppress findings by rule id.
* URL: /api/v1/suppress_by_rule
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/suppress_by_rule --data "hash=HashOfAPK&type=manifest&rule=RuleYouWantToSuppress" -H "Authorization:YourAPIKey"

=== Suppress by Files ===

* Function: Suppress findings by files.
* URL: /api/v1/suppress_by_files
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/suppress_by_files --data "hash=HashOfAPK&type=code&rule=RuleYouWantToSuppress" -H "Authorization:YourAPIKey"

=== List Suppressions ===

* Function: View suppressions associated with a scan.
* URL: /api/v1/list_suppressions
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/list_suppressions --data "hash=HashOfAPK" -H "Authorization:YourAPIKey"

=== Delete Suppressions ===

* Function: Delete suppressions.
* URL: /api/v1/delete_suppression
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/list_suppressions --data "hash=HashOfAPK&kind=file&type=code&rule=RuleYouSuppressed" -H "Authorization:YourAPIKey"

== Use Cases ==

=== CI/CD Integration ===

* Description: Automatically analyize mobile applications during the build process, in order to catch security issues before application deployment.
* Implementation: Include MobSF API calls into the CI/CD pipeline to carry out scans automatically. Retrieve and parse the reults to determine if the build passes all required security criteria.
* Benefits: Every build is checked for scurity flaws, therefore reducing the risk of deploying vulnerable applications.

=== Scheduled Scans ===

* Description: Perform regular security scans on mobile applications to ensure they remain secure over time after deployment.
* Implementation: Set up cron jobs or scheduled tasks that use the MobSF API to scan at regular intervals. Collect and review the reports to see if new vulnerabilities apper.
* Benefits: Maintains security assessment over time, helping to detect and mitigate vulnerabilities introduced with updates or changes in the threat landscape.

=== Bulk analysis ===

* Description: Automate the analysis of multiple applications.
* Implementation: Develop scripts that use the MobSF API to queue and process multiple applications at once, collecting and comparing the results.
* Benefits: Manages the security assessment of portfolios of applications, making sure all of them are constantly evaluated and remain secure.

== Example Code ==

This is a simple example of automation of static Analysis in MobSF. It uploads a file, scans this file, and locally creates a pdf report of the static analysis of the APK.
<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Important</b>: Make sure to input your API Key before using the script.</div>

import sys
import os
import json
import requests
from requests_toolbelt.multipart.encoder import MultipartEncoder
# -----------------
SERVER = "Put the URL to your MobSF instance here, like http://127.0.0.1:8000"
APIKEY = 'Put your API Key here'
# -----------------
def upload(file_path):
"""Upload File"""
print("Uploading file:", file_path)
multipart_data = MultipartEncoder(fields={'file': (os.path.basename(file_path), open(file_path, 'rb'), 'application/octet-stream')})
headers = {
'Content-Type': multipart_data.content_type,
'Authorization': APIKEY
}
print("Headers for upload:", headers) # Debugging line to check headers
response = requests.post(SERVER + '/api/v1/upload', data=multipart_data, headers=headers)
print("Upload response:", response.text)
return response.json()
# -----------------
def scan(upload_response):
"""Scan the file"""
print("Scanning file")
post_dict = {'hash': upload_response['hash']}
headers = {'Authorization': APIKEY}
response = requests.post(SERVER + '/api/v1/scan', data=post_dict, headers=headers)
print("Scan response:", response.text)
return upload_response['hash']
# -----------------
def pdf(file_hash):
"""Generate PDF Report"""
print("Generate PDF report")
headers = {'Authorization': APIKEY}
data = {"hash": file_hash}
response = requests.post(SERVER + '/api/v1/download_pdf', data=data, headers=headers, stream=True)
with open("report.pdf", 'wb') as flip:
for chunk in response.iter_content(chunk_size=1024):
if chunk:
flip.write(chunk)
print("Report saved as report.pdf")
# -----------------
if __name__ == "__main__":
if len(sys.argv) != 2:
print("Usage: python script_name.py <apk_file>")
sys.exit(1)
apk_file_path = sys.argv[1]
# -----------------
if not os.path.isfile(apk_file_path) or not apk_file_path.endswith(".apk"):
print("Invalid APK file:", apk_file_path)
sys.exit(1)
upload_response = upload(apk_file_path)
# -----------------
if 'hash' not in upload_response:
print("Failed to upload the APK file. Response:", upload_response)
sys.exit(1)
# -----------------
file_hash = scan(upload_response)
pdf(file_hash)

The script can be executed as follows:

python "ScriptName" "PathToAPK"

== References ==

* https://mobsf.live/api_docs
* https://github.com/MobSF/Mobile-Security-Framework-MobSF

[[Category:Documentation]]
[[Category:Pentesting]]

Mobile Security: Automation of APK Analysis with MobSF

2024-06-21T14:20:52Z

MKerndl: Added reference

== Summary ==

This article explores the automation of the Mobile Security Framework MobSF using its API, highlighting key features of the automation of static analysis for mobile applications. It discusses the API endpoints available in MobSF and shows how they can be integrated into scripts. Practical use cases are being presented, to demostrate how MobSF automation enhances mobile seucurity during the development lifecycle of a mobile application.

== Mobile Security Framework ==

Mobile Security Framework (MobSF) is a mobile application pentesting tool, capable of performing static as well as dynamic analyses. It is well known for its ability to analyze APK files for Android applications and IPA files for IOS applications. It provides detailed security assessments and vulnerability reports. MobSF supports a lot of different functionalities, including code analysis, binary analysis and runtime behavior analysis, therefore making it an important tool for mobile application security testing.

== Automation of static analysis ==

Static analysis in MobSF can be automated by implementing one of the numerous different API endpoints, which offer a wide range of functionalities.

=== Upload a File ===

* Function: API to upload a file. Supported file types are apk, zip, ipa and appx.
* URL: /api/v1/upload
* Sample Call:
curl -F 'file=@/Users/YourUser/Desktop/base.apk' http://localhost:8000/api/v1/upload -H "Authorization:YourAPIKey"

=== Scan a File ===

* Function: API to scan a file that is already uploaded. Supports scanning apk, xapk, apks, jar, aar, zip, ipa, so, dylib, a, and appx extensions.
* URL: /api/v1/scan
* Sample Call:
curl -F 'file=@/Users/YourUser/Desktop/base.apk' http://localhost:8000/api/v1/scan -H "Authorization:YourAPIKey"

=== Display Recent Scans ===

* Function: API to display recent scans.
* URL: /api/v1/scans
* Sample Call:
curl --url "http://localhost:8000/api/v1/scans" -H "Authorization:YourAPIKey"

=== Delete a Scan ===

* Function: API to scan a file that is already uploaded. Supports scanning apk, xapk, apks, jar, aar, zip, ipa, so, dylib, a, and appx extensions.
* URL: /api/v1/scan
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/delete_scan --data "hash=HashOfAPK" -H "Authorization:YourAPIKey"

=== App Scorecard ===

* Function: Get MobSF Application Security Scorecard.
* URL: /api/v1/scorecard
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/scorecard --data "hash=HashOfAPK" -H "Authorization:YourAPIKey"

=== Download PDF Report ===

* Function: API to generate PDF report.
* URL: /api/v1/download_pdf
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/download_pdf --data "hash=HashOfAPK" -H "Authorization:YourAPIKey"

=== Generate JSON Report ===

* Function: API to generate JSON report.
* URL: /api/v1/report_json
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/report_json --data "hash=HashOfAPK" -H "Authorization:YourAPIKey"

=== View Source Files ===

* Function: API to view source files.
* URL: /api/v1/view_source
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/view_source --data "hash=HashOfAPK&type=apk&file=b/a/a/a/a/a.java" -H "Authorization:YourAPIKey"

=== Compare Apps ===

* Function: API to compare scan results.
* URL: /api/v1/compare
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/compare --data "hash=HashOfAPK&hash2=HashOfOtherAPK" -H "Authorization:YourAPIKey"

=== Suppress by Rule ===

* Function: Suppress findings by rule id.
* URL: /api/v1/suppress_by_rule
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/suppress_by_rule --data "hash=HashOfAPK&type=manifest&rule=RuleYouWantToSuppress" -H "Authorization:YourAPIKey"

=== Suppress by Files ===

* Function: Suppress findings by files.
* URL: /api/v1/suppress_by_files
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/suppress_by_files --data "hash=HashOfAPK&type=code&rule=RuleYouWantToSuppress" -H "Authorization:YourAPIKey"

=== List Suppressions ===

* Function: View suppressions associated with a scan.
* URL: /api/v1/list_suppressions
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/list_suppressions --data "hash=HashOfAPK" -H "Authorization:YourAPIKey"

=== Delete Suppressions ===

* Function: Delete suppressions.
* URL: /api/v1/delete_suppression
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/list_suppressions --data "hash=HashOfAPK&kind=file&type=code&rule=RuleYouSuppressed" -H "Authorization:YourAPIKey"

== Use Cases ==

=== CI/CD Integration ===

* Description: Automatically analyize mobile applications during the build process, in order to catch security issues before application deployment.
* Implementation: Include MobSF API calls into the CI/CD pipeline to carry out scans automatically. Retrieve and parse the reults to determine if the build passes all required security criteria.
* Benefits: Every build is checked for scurity flaws, therefore reducing the risk of deploying vulnerable applications.

=== Scheduled Scans ===

* Description: Perform regular security scans on mobile applications to ensure they remain secure over time after deployment.
* Implementation: Set up cron jobs or scheduled tasks that use the MobSF API to scan at regular intervals. Collect and review the reports to see if new vulnerabilities apper.
* Benefits: Maintains security assessment over time, helping to detect and mitigate vulnerabilities introduced with updates or changes in the threat landscape.

=== Bulk analysis ===

* Description: Automate the analysis of multiple applications.
* Implementation: Develop scripts that use the MobSF API to queue and process multiple applications at once, collecting and comparing the results.
* Benefits: Manages the security assessment of portfolios of applications, making sure all of them are constantly evaluated and remain secure.

== Example Code ==

This is a simple example of automation of static Analysis in MobSF. It uploads a file, scans this file, and locally creates a pdf report of the static analysis of the APK.
<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Important</b>: Make sure to input your API Key before using the script.</div>

import sys
import os
import json
import requests
from requests_toolbelt.multipart.encoder import MultipartEncoder
# -----------------
SERVER = "http://127.0.0.1:8000"
APIKEY = '266ffc5f22d163c20aea506e9c54a67d8517a4f0e2fc868938080bd9c96b03e6'
# -----------------
def upload(file_path):
"""Upload File"""
print("Uploading file:", file_path)
multipart_data = MultipartEncoder(fields={'file': (os.path.basename(file_path), open(file_path, 'rb'), 'application/octet-stream')})
headers = {
'Content-Type': multipart_data.content_type,
'Authorization': APIKEY
}
print("Headers for upload:", headers) # Debugging line to check headers
response = requests.post(SERVER + '/api/v1/upload', data=multipart_data, headers=headers)
print("Upload response:", response.text)
return response.json()
# -----------------
def scan(upload_response):
"""Scan the file"""
print("Scanning file")
post_dict = {'hash': upload_response['hash']}
headers = {'Authorization': APIKEY}
response = requests.post(SERVER + '/api/v1/scan', data=post_dict, headers=headers)
print("Scan response:", response.text)
return upload_response['hash']
# -----------------
def pdf(file_hash):
"""Generate PDF Report"""
print("Generate PDF report")
headers = {'Authorization': APIKEY}
data = {"hash": file_hash}
response = requests.post(SERVER + '/api/v1/download_pdf', data=data, headers=headers, stream=True)
with open("report.pdf", 'wb') as flip:
for chunk in response.iter_content(chunk_size=1024):
if chunk:
flip.write(chunk)
print("Report saved as report.pdf")
# -----------------
if __name__ == "__main__":
if len(sys.argv) != 2:
print("Usage: python script_name.py <apk_file>")
sys.exit(1)
apk_file_path = sys.argv[1]
# -----------------
if not os.path.isfile(apk_file_path) or not apk_file_path.endswith(".apk"):
print("Invalid APK file:", apk_file_path)
sys.exit(1)
upload_response = upload(apk_file_path)
# -----------------
if 'hash' not in upload_response:
print("Failed to upload the APK file. Response:", upload_response)
sys.exit(1)
# -----------------
file_hash = scan(upload_response)
pdf(file_hash)

The script can be executed as follows:

python "ScriptName" "PathToAPK"

== References ==

* https://mobsf.live/api_docs
* https://github.com/MobSF/Mobile-Security-Framework-MobSF

[[Category:Documentation]]
[[Category:Pentesting]]

Mobile Security: Automation of APK Analysis with MobSF

2024-06-21T08:42:20Z

MKerndl: /* Mobile Security Framework */

== Summary ==

This article explores the automation of the Mobile Security Framework MobSF using its API, highlighting key features of the automation of static analysis for mobile applications. It discusses the API endpoints available in MobSF and shows how they can be integrated into scripts. Practical use cases are being presented, to demostrate how MobSF automation enhances mobile seucurity during the development lifecycle of a mobile application.

== Mobile Security Framework ==

Mobile Security Framework (MobSF) is a mobile application pentesting tool, capable of performing static as well as dynamic analyses. It is well known for its ability to analyze APK files for Android applications and IPA files for IOS applications. It provides detailed security assessments and vulnerability reports. MobSF supports a lot of different functionalities, including code analysis, binary analysis and runtime behavior analysis, therefore making it an important tool for mobile application security testing.

== Automation of static analysis ==

Static analysis in MobSF can be automated by implementing one of the numerous different API endpoints, which offer a wide range of functionalities.

=== Upload a File ===

* Function: API to upload a file. Supported file types are apk, zip, ipa and appx.
* URL: /api/v1/upload
* Sample Call:
curl -F 'file=@/Users/YourUser/Desktop/base.apk' http://localhost:8000/api/v1/upload -H "Authorization:YourAPIKey"

=== Scan a File ===

* Function: API to scan a file that is already uploaded. Supports scanning apk, xapk, apks, jar, aar, zip, ipa, so, dylib, a, and appx extensions.
* URL: /api/v1/scan
* Sample Call:
curl -F 'file=@/Users/YourUser/Desktop/base.apk' http://localhost:8000/api/v1/scan -H "Authorization:YourAPIKey"

=== Display Recent Scans ===

* Function: API to display recent scans.
* URL: /api/v1/scans
* Sample Call:
curl --url "http://localhost:8000/api/v1/scans" -H "Authorization:YourAPIKey"

=== Delete a Scan ===

* Function: API to scan a file that is already uploaded. Supports scanning apk, xapk, apks, jar, aar, zip, ipa, so, dylib, a, and appx extensions.
* URL: /api/v1/scan
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/delete_scan --data "hash=HashOfAPK" -H "Authorization:YourAPIKey"

=== App Scorecard ===

* Function: Get MobSF Application Security Scorecard.
* URL: /api/v1/scorecard
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/scorecard --data "hash=HashOfAPK" -H "Authorization:YourAPIKey"

=== Download PDF Report ===

* Function: API to generate PDF report.
* URL: /api/v1/download_pdf
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/download_pdf --data "hash=HashOfAPK" -H "Authorization:YourAPIKey"

=== Generate JSON Report ===

* Function: API to generate JSON report.
* URL: /api/v1/report_json
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/report_json --data "hash=HashOfAPK" -H "Authorization:YourAPIKey"

=== View Source Files ===

* Function: API to view source files.
* URL: /api/v1/view_source
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/view_source --data "hash=HashOfAPK&type=apk&file=b/a/a/a/a/a.java" -H "Authorization:YourAPIKey"

=== Compare Apps ===

* Function: API to compare scan results.
* URL: /api/v1/compare
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/compare --data "hash=HashOfAPK&hash2=HashOfOtherAPK" -H "Authorization:YourAPIKey"

=== Suppress by Rule ===

* Function: Suppress findings by rule id.
* URL: /api/v1/suppress_by_rule
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/suppress_by_rule --data "hash=HashOfAPK&type=manifest&rule=RuleYouWantToSuppress" -H "Authorization:YourAPIKey"

=== Suppress by Files ===

* Function: Suppress findings by files.
* URL: /api/v1/suppress_by_files
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/suppress_by_files --data "hash=HashOfAPK&type=code&rule=RuleYouWantToSuppress" -H "Authorization:YourAPIKey"

=== List Suppressions ===

* Function: View suppressions associated with a scan.
* URL: /api/v1/list_suppressions
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/list_suppressions --data "hash=HashOfAPK" -H "Authorization:YourAPIKey"

=== Delete Suppressions ===

* Function: Delete suppressions.
* URL: /api/v1/delete_suppression
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/list_suppressions --data "hash=HashOfAPK&kind=file&type=code&rule=RuleYouSuppressed" -H "Authorization:YourAPIKey"

== Use Cases ==

=== CI/CD Integration ===

* Description: Automatically analyize mobile applications during the build process, in order to catch security issues before application deployment.
* Implementation: Include MobSF API calls into the CI/CD pipeline to carry out scans automatically. Retrieve and parse the reults to determine if the build passes all required security criteria.
* Benefits: Every build is checked for scurity flaws, therefore reducing the risk of deploying vulnerable applications.

=== Scheduled Scans ===

* Description: Perform regular security scans on mobile applications to ensure they remain secure over time after deployment.
* Implementation: Set up cron jobs or scheduled tasks that use the MobSF API to scan at regular intervals. Collect and review the reports to see if new vulnerabilities apper.
* Benefits: Maintains security assessment over time, helping to detect and mitigate vulnerabilities introduced with updates or changes in the threat landscape.

=== Bulk analysis ===

* Description: Automate the analysis of multiple applications.
* Implementation: Develop scripts that use the MobSF API to queue and process multiple applications at once, collecting and comparing the results.
* Benefits: Manages the security assessment of portfolios of applications, making sure all of them are constantly evaluated and remain secure.

== Example Code ==

This is a simple example of automation of static Analysis in MobSF. It uploads a file, scans this file, and locally creates a pdf report of the static analysis of the APK.
<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Important</b>: Make sure to input your API Key before using the script.</div>

import sys
import os
import json
import requests
from requests_toolbelt.multipart.encoder import MultipartEncoder
# -----------------
SERVER = "http://127.0.0.1:8000"
APIKEY = '266ffc5f22d163c20aea506e9c54a67d8517a4f0e2fc868938080bd9c96b03e6'
# -----------------
def upload(file_path):
"""Upload File"""
print("Uploading file:", file_path)
multipart_data = MultipartEncoder(fields={'file': (os.path.basename(file_path), open(file_path, 'rb'), 'application/octet-stream')})
headers = {
'Content-Type': multipart_data.content_type,
'Authorization': APIKEY
}
print("Headers for upload:", headers) # Debugging line to check headers
response = requests.post(SERVER + '/api/v1/upload', data=multipart_data, headers=headers)
print("Upload response:", response.text)
return response.json()
# -----------------
def scan(upload_response):
"""Scan the file"""
print("Scanning file")
post_dict = {'hash': upload_response['hash']}
headers = {'Authorization': APIKEY}
response = requests.post(SERVER + '/api/v1/scan', data=post_dict, headers=headers)
print("Scan response:", response.text)
return upload_response['hash']
# -----------------
def pdf(file_hash):
"""Generate PDF Report"""
print("Generate PDF report")
headers = {'Authorization': APIKEY}
data = {"hash": file_hash}
response = requests.post(SERVER + '/api/v1/download_pdf', data=data, headers=headers, stream=True)
with open("report.pdf", 'wb') as flip:
for chunk in response.iter_content(chunk_size=1024):
if chunk:
flip.write(chunk)
print("Report saved as report.pdf")
# -----------------
if __name__ == "__main__":
if len(sys.argv) != 2:
print("Usage: python script_name.py <apk_file>")
sys.exit(1)
apk_file_path = sys.argv[1]
# -----------------
if not os.path.isfile(apk_file_path) or not apk_file_path.endswith(".apk"):
print("Invalid APK file:", apk_file_path)
sys.exit(1)
upload_response = upload(apk_file_path)
# -----------------
if 'hash' not in upload_response:
print("Failed to upload the APK file. Response:", upload_response)
sys.exit(1)
# -----------------
file_hash = scan(upload_response)
pdf(file_hash)

The script can be executed as follows:

python "ScriptName" "PathToAPK"

== References ==

* https://mobsf.live/api_docs

[[Category:Documentation]]
[[Category:Pentesting]]

Mobile Security: Automation of APK Analysis with MobSF

2024-06-21T08:39:19Z

MKerndl: /* Mobile Security Framework */

== Summary ==

This article explores the automation of the Mobile Security Framework MobSF using its API, highlighting key features of the automation of static analysis for mobile applications. It discusses the API endpoints available in MobSF and shows how they can be integrated into scripts. Practical use cases are being presented, to demostrate how MobSF automation enhances mobile seucurity during the development lifecycle of a mobile application.

== Mobile Security Framework ==

Mobile Security Framework (MobSF) is a mobile application pentesting tool, capable of performing static as well as dynamic analyses. It is well known for its ability to analyze APK files for Android applications and IPA files for IOS applications. It provides detailed security assessments and vulnerability reports

== Automation of static analysis ==

Static analysis in MobSF can be automated by implementing one of the numerous different API endpoints, which offer a wide range of functionalities.

=== Upload a File ===

* Function: API to upload a file. Supported file types are apk, zip, ipa and appx.
* URL: /api/v1/upload
* Sample Call:
curl -F 'file=@/Users/YourUser/Desktop/base.apk' http://localhost:8000/api/v1/upload -H "Authorization:YourAPIKey"

=== Scan a File ===

* Function: API to scan a file that is already uploaded. Supports scanning apk, xapk, apks, jar, aar, zip, ipa, so, dylib, a, and appx extensions.
* URL: /api/v1/scan
* Sample Call:
curl -F 'file=@/Users/YourUser/Desktop/base.apk' http://localhost:8000/api/v1/scan -H "Authorization:YourAPIKey"

=== Display Recent Scans ===

* Function: API to display recent scans.
* URL: /api/v1/scans
* Sample Call:
curl --url "http://localhost:8000/api/v1/scans" -H "Authorization:YourAPIKey"

=== Delete a Scan ===

* Function: API to scan a file that is already uploaded. Supports scanning apk, xapk, apks, jar, aar, zip, ipa, so, dylib, a, and appx extensions.
* URL: /api/v1/scan
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/delete_scan --data "hash=HashOfAPK" -H "Authorization:YourAPIKey"

=== App Scorecard ===

* Function: Get MobSF Application Security Scorecard.
* URL: /api/v1/scorecard
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/scorecard --data "hash=HashOfAPK" -H "Authorization:YourAPIKey"

=== Download PDF Report ===

* Function: API to generate PDF report.
* URL: /api/v1/download_pdf
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/download_pdf --data "hash=HashOfAPK" -H "Authorization:YourAPIKey"

=== Generate JSON Report ===

* Function: API to generate JSON report.
* URL: /api/v1/report_json
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/report_json --data "hash=HashOfAPK" -H "Authorization:YourAPIKey"

=== View Source Files ===

* Function: API to view source files.
* URL: /api/v1/view_source
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/view_source --data "hash=HashOfAPK&type=apk&file=b/a/a/a/a/a.java" -H "Authorization:YourAPIKey"

=== Compare Apps ===

* Function: API to compare scan results.
* URL: /api/v1/compare
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/compare --data "hash=HashOfAPK&hash2=HashOfOtherAPK" -H "Authorization:YourAPIKey"

=== Suppress by Rule ===

* Function: Suppress findings by rule id.
* URL: /api/v1/suppress_by_rule
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/suppress_by_rule --data "hash=HashOfAPK&type=manifest&rule=RuleYouWantToSuppress" -H "Authorization:YourAPIKey"

=== Suppress by Files ===

* Function: Suppress findings by files.
* URL: /api/v1/suppress_by_files
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/suppress_by_files --data "hash=HashOfAPK&type=code&rule=RuleYouWantToSuppress" -H "Authorization:YourAPIKey"

=== List Suppressions ===

* Function: View suppressions associated with a scan.
* URL: /api/v1/list_suppressions
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/list_suppressions --data "hash=HashOfAPK" -H "Authorization:YourAPIKey"

=== Delete Suppressions ===

* Function: Delete suppressions.
* URL: /api/v1/delete_suppression
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/list_suppressions --data "hash=HashOfAPK&kind=file&type=code&rule=RuleYouSuppressed" -H "Authorization:YourAPIKey"

== Use Cases ==

=== CI/CD Integration ===

* Description: Automatically analyize mobile applications during the build process, in order to catch security issues before application deployment.
* Implementation: Include MobSF API calls into the CI/CD pipeline to carry out scans automatically. Retrieve and parse the reults to determine if the build passes all required security criteria.
* Benefits: Every build is checked for scurity flaws, therefore reducing the risk of deploying vulnerable applications.

=== Scheduled Scans ===

* Description: Perform regular security scans on mobile applications to ensure they remain secure over time after deployment.
* Implementation: Set up cron jobs or scheduled tasks that use the MobSF API to scan at regular intervals. Collect and review the reports to see if new vulnerabilities apper.
* Benefits: Maintains security assessment over time, helping to detect and mitigate vulnerabilities introduced with updates or changes in the threat landscape.

=== Bulk analysis ===

* Description: Automate the analysis of multiple applications.
* Implementation: Develop scripts that use the MobSF API to queue and process multiple applications at once, collecting and comparing the results.
* Benefits: Manages the security assessment of portfolios of applications, making sure all of them are constantly evaluated and remain secure.

== Example Code ==

This is a simple example of automation of static Analysis in MobSF. It uploads a file, scans this file, and locally creates a pdf report of the static analysis of the APK.
<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Important</b>: Make sure to input your API Key before using the script.</div>

import sys
import os
import json
import requests
from requests_toolbelt.multipart.encoder import MultipartEncoder
# -----------------
SERVER = "http://127.0.0.1:8000"
APIKEY = '266ffc5f22d163c20aea506e9c54a67d8517a4f0e2fc868938080bd9c96b03e6'
# -----------------
def upload(file_path):
"""Upload File"""
print("Uploading file:", file_path)
multipart_data = MultipartEncoder(fields={'file': (os.path.basename(file_path), open(file_path, 'rb'), 'application/octet-stream')})
headers = {
'Content-Type': multipart_data.content_type,
'Authorization': APIKEY
}
print("Headers for upload:", headers) # Debugging line to check headers
response = requests.post(SERVER + '/api/v1/upload', data=multipart_data, headers=headers)
print("Upload response:", response.text)
return response.json()
# -----------------
def scan(upload_response):
"""Scan the file"""
print("Scanning file")
post_dict = {'hash': upload_response['hash']}
headers = {'Authorization': APIKEY}
response = requests.post(SERVER + '/api/v1/scan', data=post_dict, headers=headers)
print("Scan response:", response.text)
return upload_response['hash']
# -----------------
def pdf(file_hash):
"""Generate PDF Report"""
print("Generate PDF report")
headers = {'Authorization': APIKEY}
data = {"hash": file_hash}
response = requests.post(SERVER + '/api/v1/download_pdf', data=data, headers=headers, stream=True)
with open("report.pdf", 'wb') as flip:
for chunk in response.iter_content(chunk_size=1024):
if chunk:
flip.write(chunk)
print("Report saved as report.pdf")
# -----------------
if __name__ == "__main__":
if len(sys.argv) != 2:
print("Usage: python script_name.py <apk_file>")
sys.exit(1)
apk_file_path = sys.argv[1]
# -----------------
if not os.path.isfile(apk_file_path) or not apk_file_path.endswith(".apk"):
print("Invalid APK file:", apk_file_path)
sys.exit(1)
upload_response = upload(apk_file_path)
# -----------------
if 'hash' not in upload_response:
print("Failed to upload the APK file. Response:", upload_response)
sys.exit(1)
# -----------------
file_hash = scan(upload_response)
pdf(file_hash)

The script can be executed as follows:

python "ScriptName" "PathToAPK"

== References ==

* https://mobsf.live/api_docs

[[Category:Documentation]]
[[Category:Pentesting]]

Mobile Security: Automation of APK Analysis with MobSF

2024-06-21T08:31:36Z

MKerndl: Expanded summary

== Summary ==

This article explores the automation of the Mobile Security Framework MobSF using its API, highlighting key features of the automation of static analysis for mobile applications. It discusses the API endpoints available in MobSF and shows how they can be integrated into scripts. Practical use cases are being presented, to demostrate how MobSF automation enhances mobile seucurity during the development lifecycle of a mobile application.

== Mobile Security Framework ==

Mobile Security Framework (MobSF) is an all-in mobile application pentesting tool. It is capable of performing static and dynamic analyses of APKs and is widely used for analyzing Android and IOS mobile applications.

== Automation of static analysis ==

Static analysis in MobSF can be automated by implementing one of the numerous different API endpoints, which offer a wide range of functionalities.

=== Upload a File ===

* Function: API to upload a file. Supported file types are apk, zip, ipa and appx.
* URL: /api/v1/upload
* Sample Call:
curl -F 'file=@/Users/YourUser/Desktop/base.apk' http://localhost:8000/api/v1/upload -H "Authorization:YourAPIKey"

=== Scan a File ===

* Function: API to scan a file that is already uploaded. Supports scanning apk, xapk, apks, jar, aar, zip, ipa, so, dylib, a, and appx extensions.
* URL: /api/v1/scan
* Sample Call:
curl -F 'file=@/Users/YourUser/Desktop/base.apk' http://localhost:8000/api/v1/scan -H "Authorization:YourAPIKey"

=== Display Recent Scans ===

* Function: API to display recent scans.
* URL: /api/v1/scans
* Sample Call:
curl --url "http://localhost:8000/api/v1/scans" -H "Authorization:YourAPIKey"

=== Delete a Scan ===

* Function: API to scan a file that is already uploaded. Supports scanning apk, xapk, apks, jar, aar, zip, ipa, so, dylib, a, and appx extensions.
* URL: /api/v1/scan
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/delete_scan --data "hash=HashOfAPK" -H "Authorization:YourAPIKey"

=== App Scorecard ===

* Function: Get MobSF Application Security Scorecard.
* URL: /api/v1/scorecard
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/scorecard --data "hash=HashOfAPK" -H "Authorization:YourAPIKey"

=== Download PDF Report ===

* Function: API to generate PDF report.
* URL: /api/v1/download_pdf
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/download_pdf --data "hash=HashOfAPK" -H "Authorization:YourAPIKey"

=== Generate JSON Report ===

* Function: API to generate JSON report.
* URL: /api/v1/report_json
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/report_json --data "hash=HashOfAPK" -H "Authorization:YourAPIKey"

=== View Source Files ===

* Function: API to view source files.
* URL: /api/v1/view_source
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/view_source --data "hash=HashOfAPK&type=apk&file=b/a/a/a/a/a.java" -H "Authorization:YourAPIKey"

=== Compare Apps ===

* Function: API to compare scan results.
* URL: /api/v1/compare
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/compare --data "hash=HashOfAPK&hash2=HashOfOtherAPK" -H "Authorization:YourAPIKey"

=== Suppress by Rule ===

* Function: Suppress findings by rule id.
* URL: /api/v1/suppress_by_rule
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/suppress_by_rule --data "hash=HashOfAPK&type=manifest&rule=RuleYouWantToSuppress" -H "Authorization:YourAPIKey"

=== Suppress by Files ===

* Function: Suppress findings by files.
* URL: /api/v1/suppress_by_files
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/suppress_by_files --data "hash=HashOfAPK&type=code&rule=RuleYouWantToSuppress" -H "Authorization:YourAPIKey"

=== List Suppressions ===

* Function: View suppressions associated with a scan.
* URL: /api/v1/list_suppressions
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/list_suppressions --data "hash=HashOfAPK" -H "Authorization:YourAPIKey"

=== Delete Suppressions ===

* Function: Delete suppressions.
* URL: /api/v1/delete_suppression
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/list_suppressions --data "hash=HashOfAPK&kind=file&type=code&rule=RuleYouSuppressed" -H "Authorization:YourAPIKey"

== Use Cases ==

=== CI/CD Integration ===

* Description: Automatically analyize mobile applications during the build process, in order to catch security issues before application deployment.
* Implementation: Include MobSF API calls into the CI/CD pipeline to carry out scans automatically. Retrieve and parse the reults to determine if the build passes all required security criteria.
* Benefits: Every build is checked for scurity flaws, therefore reducing the risk of deploying vulnerable applications.

=== Scheduled Scans ===

* Description: Perform regular security scans on mobile applications to ensure they remain secure over time after deployment.
* Implementation: Set up cron jobs or scheduled tasks that use the MobSF API to scan at regular intervals. Collect and review the reports to see if new vulnerabilities apper.
* Benefits: Maintains security assessment over time, helping to detect and mitigate vulnerabilities introduced with updates or changes in the threat landscape.

=== Bulk analysis ===

* Description: Automate the analysis of multiple applications.
* Implementation: Develop scripts that use the MobSF API to queue and process multiple applications at once, collecting and comparing the results.
* Benefits: Manages the security assessment of portfolios of applications, making sure all of them are constantly evaluated and remain secure.

== Example Code ==

This is a simple example of automation of static Analysis in MobSF. It uploads a file, scans this file, and locally creates a pdf report of the static analysis of the APK.
<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Important</b>: Make sure to input your API Key before using the script.</div>

import sys
import os
import json
import requests
from requests_toolbelt.multipart.encoder import MultipartEncoder
# -----------------
SERVER = "http://127.0.0.1:8000"
APIKEY = '266ffc5f22d163c20aea506e9c54a67d8517a4f0e2fc868938080bd9c96b03e6'
# -----------------
def upload(file_path):
"""Upload File"""
print("Uploading file:", file_path)
multipart_data = MultipartEncoder(fields={'file': (os.path.basename(file_path), open(file_path, 'rb'), 'application/octet-stream')})
headers = {
'Content-Type': multipart_data.content_type,
'Authorization': APIKEY
}
print("Headers for upload:", headers) # Debugging line to check headers
response = requests.post(SERVER + '/api/v1/upload', data=multipart_data, headers=headers)
print("Upload response:", response.text)
return response.json()
# -----------------
def scan(upload_response):
"""Scan the file"""
print("Scanning file")
post_dict = {'hash': upload_response['hash']}
headers = {'Authorization': APIKEY}
response = requests.post(SERVER + '/api/v1/scan', data=post_dict, headers=headers)
print("Scan response:", response.text)
return upload_response['hash']
# -----------------
def pdf(file_hash):
"""Generate PDF Report"""
print("Generate PDF report")
headers = {'Authorization': APIKEY}
data = {"hash": file_hash}
response = requests.post(SERVER + '/api/v1/download_pdf', data=data, headers=headers, stream=True)
with open("report.pdf", 'wb') as flip:
for chunk in response.iter_content(chunk_size=1024):
if chunk:
flip.write(chunk)
print("Report saved as report.pdf")
# -----------------
if __name__ == "__main__":
if len(sys.argv) != 2:
print("Usage: python script_name.py <apk_file>")
sys.exit(1)
apk_file_path = sys.argv[1]
# -----------------
if not os.path.isfile(apk_file_path) or not apk_file_path.endswith(".apk"):
print("Invalid APK file:", apk_file_path)
sys.exit(1)
upload_response = upload(apk_file_path)
# -----------------
if 'hash' not in upload_response:
print("Failed to upload the APK file. Response:", upload_response)
sys.exit(1)
# -----------------
file_hash = scan(upload_response)
pdf(file_hash)

The script can be executed as follows:

python "ScriptName" "PathToAPK"

== References ==

* https://mobsf.live/api_docs

[[Category:Documentation]]
[[Category:Pentesting]]

Mobile Security: Automation of APK Analysis with MobSF

2024-06-21T08:26:33Z

MKerndl: Added Category

== Summary ==

This article explores the automation of the Mobile Security Framework MobSF using its API, highlighting key features of the automation of static analysis as well as discussing practical use cases to demonstrate how MobSF automation enhances mobile security.

== Mobile Security Framework ==

Mobile Security Framework (MobSF) is an all-in mobile application pentesting tool. It is capable of performing static and dynamic analyses of APKs and is widely used for analyzing Android and IOS mobile applications.

== Automation of static analysis ==

Static analysis in MobSF can be automated by implementing one of the numerous different API endpoints, which offer a wide range of functionalities.

=== Upload a File ===

* Function: API to upload a file. Supported file types are apk, zip, ipa and appx.
* URL: /api/v1/upload
* Sample Call:
curl -F 'file=@/Users/YourUser/Desktop/base.apk' http://localhost:8000/api/v1/upload -H "Authorization:YourAPIKey"

=== Scan a File ===

* Function: API to scan a file that is already uploaded. Supports scanning apk, xapk, apks, jar, aar, zip, ipa, so, dylib, a, and appx extensions.
* URL: /api/v1/scan
* Sample Call:
curl -F 'file=@/Users/YourUser/Desktop/base.apk' http://localhost:8000/api/v1/scan -H "Authorization:YourAPIKey"

=== Display Recent Scans ===

* Function: API to display recent scans.
* URL: /api/v1/scans
* Sample Call:
curl --url "http://localhost:8000/api/v1/scans" -H "Authorization:YourAPIKey"

=== Delete a Scan ===

* Function: API to scan a file that is already uploaded. Supports scanning apk, xapk, apks, jar, aar, zip, ipa, so, dylib, a, and appx extensions.
* URL: /api/v1/scan
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/delete_scan --data "hash=HashOfAPK" -H "Authorization:YourAPIKey"

=== App Scorecard ===

* Function: Get MobSF Application Security Scorecard.
* URL: /api/v1/scorecard
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/scorecard --data "hash=HashOfAPK" -H "Authorization:YourAPIKey"

=== Download PDF Report ===

* Function: API to generate PDF report.
* URL: /api/v1/download_pdf
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/download_pdf --data "hash=HashOfAPK" -H "Authorization:YourAPIKey"

=== Generate JSON Report ===

* Function: API to generate JSON report.
* URL: /api/v1/report_json
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/report_json --data "hash=HashOfAPK" -H "Authorization:YourAPIKey"

=== View Source Files ===

* Function: API to view source files.
* URL: /api/v1/view_source
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/view_source --data "hash=HashOfAPK&type=apk&file=b/a/a/a/a/a.java" -H "Authorization:YourAPIKey"

=== Compare Apps ===

* Function: API to compare scan results.
* URL: /api/v1/compare
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/compare --data "hash=HashOfAPK&hash2=HashOfOtherAPK" -H "Authorization:YourAPIKey"

=== Suppress by Rule ===

* Function: Suppress findings by rule id.
* URL: /api/v1/suppress_by_rule
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/suppress_by_rule --data "hash=HashOfAPK&type=manifest&rule=RuleYouWantToSuppress" -H "Authorization:YourAPIKey"

=== Suppress by Files ===

* Function: Suppress findings by files.
* URL: /api/v1/suppress_by_files
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/suppress_by_files --data "hash=HashOfAPK&type=code&rule=RuleYouWantToSuppress" -H "Authorization:YourAPIKey"

=== List Suppressions ===

* Function: View suppressions associated with a scan.
* URL: /api/v1/list_suppressions
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/list_suppressions --data "hash=HashOfAPK" -H "Authorization:YourAPIKey"

=== Delete Suppressions ===

* Function: Delete suppressions.
* URL: /api/v1/delete_suppression
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/list_suppressions --data "hash=HashOfAPK&kind=file&type=code&rule=RuleYouSuppressed" -H "Authorization:YourAPIKey"

== Use Cases ==

=== CI/CD Integration ===

* Description: Automatically analyize mobile applications during the build process, in order to catch security issues before application deployment.
* Implementation: Include MobSF API calls into the CI/CD pipeline to carry out scans automatically. Retrieve and parse the reults to determine if the build passes all required security criteria.
* Benefits: Every build is checked for scurity flaws, therefore reducing the risk of deploying vulnerable applications.

=== Scheduled Scans ===

* Description: Perform regular security scans on mobile applications to ensure they remain secure over time after deployment.
* Implementation: Set up cron jobs or scheduled tasks that use the MobSF API to scan at regular intervals. Collect and review the reports to see if new vulnerabilities apper.
* Benefits: Maintains security assessment over time, helping to detect and mitigate vulnerabilities introduced with updates or changes in the threat landscape.

=== Bulk analysis ===

* Description: Automate the analysis of multiple applications.
* Implementation: Develop scripts that use the MobSF API to queue and process multiple applications at once, collecting and comparing the results.
* Benefits: Manages the security assessment of portfolios of applications, making sure all of them are constantly evaluated and remain secure.

== Example Code ==

This is a simple example of automation of static Analysis in MobSF. It uploads a file, scans this file, and locally creates a pdf report of the static analysis of the APK.
<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Important</b>: Make sure to input your API Key before using the script.</div>

import sys
import os
import json
import requests
from requests_toolbelt.multipart.encoder import MultipartEncoder
# -----------------
SERVER = "http://127.0.0.1:8000"
APIKEY = '266ffc5f22d163c20aea506e9c54a67d8517a4f0e2fc868938080bd9c96b03e6'
# -----------------
def upload(file_path):
"""Upload File"""
print("Uploading file:", file_path)
multipart_data = MultipartEncoder(fields={'file': (os.path.basename(file_path), open(file_path, 'rb'), 'application/octet-stream')})
headers = {
'Content-Type': multipart_data.content_type,
'Authorization': APIKEY
}
print("Headers for upload:", headers) # Debugging line to check headers
response = requests.post(SERVER + '/api/v1/upload', data=multipart_data, headers=headers)
print("Upload response:", response.text)
return response.json()
# -----------------
def scan(upload_response):
"""Scan the file"""
print("Scanning file")
post_dict = {'hash': upload_response['hash']}
headers = {'Authorization': APIKEY}
response = requests.post(SERVER + '/api/v1/scan', data=post_dict, headers=headers)
print("Scan response:", response.text)
return upload_response['hash']
# -----------------
def pdf(file_hash):
"""Generate PDF Report"""
print("Generate PDF report")
headers = {'Authorization': APIKEY}
data = {"hash": file_hash}
response = requests.post(SERVER + '/api/v1/download_pdf', data=data, headers=headers, stream=True)
with open("report.pdf", 'wb') as flip:
for chunk in response.iter_content(chunk_size=1024):
if chunk:
flip.write(chunk)
print("Report saved as report.pdf")
# -----------------
if __name__ == "__main__":
if len(sys.argv) != 2:
print("Usage: python script_name.py <apk_file>")
sys.exit(1)
apk_file_path = sys.argv[1]
# -----------------
if not os.path.isfile(apk_file_path) or not apk_file_path.endswith(".apk"):
print("Invalid APK file:", apk_file_path)
sys.exit(1)
upload_response = upload(apk_file_path)
# -----------------
if 'hash' not in upload_response:
print("Failed to upload the APK file. Response:", upload_response)
sys.exit(1)
# -----------------
file_hash = scan(upload_response)
pdf(file_hash)

The script can be executed as follows:

python "ScriptName" "PathToAPK"

== References ==

* https://mobsf.live/api_docs

[[Category:Documentation]]
[[Category:Pentesting]]

Mobile Security: Automation of APK Analysis with MobSF

2024-06-21T08:25:43Z

MKerndl:

Mobile Security: Automation of APK Analysis with MobSF

2024-06-20T17:47:53Z

MKerndl: /* Automation of static analysis */

Mobile Security: Automation of APK Analysis with MobSF

2024-06-20T17:40:36Z

MKerndl: /* Example Code */

== Summary ==

This article explores the automation of the Mobile Security Framework MobSF using its API, highlighting key features of the automation of static analysis as well as discussing practical use cases to demonstrate how MobSF automation enhances mobile security.

== Mobile Security Framework ==

Mobile Security Framework (MobSF) is an all-in mobile application pentesting tool. It is capable of performing static and dynamic analyses of APKs and is widely used for analyzing Android and IOS mobile applications.

== Automation of static analysis ==

Static analysis in MobSF can be automated using a script, implementing one of the numerous different API endpoints, which offer a wide range of functionalities.

=== Upload a File ===

* Function: API to upload a file. Supported file types are apk, zip, ipa and appx.
* URL: /api/v1/upload
* Sample Call:
curl -F 'file=@/Users/YourUser/Desktop/base.apk' http://localhost:8000/api/v1/upload -H "Authorization:YourAPIKey"

=== Scan a File ===

* Function: API to scan a file that is already uploaded. Supports scanning apk, xapk, apks, jar, aar, zip, ipa, so, dylib, a, and appx extensions.
* URL: /api/v1/scan
* Sample Call:
curl -F 'file=@/Users/YourUser/Desktop/base.apk' http://localhost:8000/api/v1/scan -H "Authorization:YourAPIKey"

=== Display Recent Scans ===

* Function: API to display recent scans.
* URL: /api/v1/scans
* Sample Call:
curl --url "http://localhost:8000/api/v1/scans" -H "Authorization:YourAPIKey"

=== Delete a Scan ===

* Function: API to scan a file that is already uploaded. Supports scanning apk, xapk, apks, jar, aar, zip, ipa, so, dylib, a, and appx extensions.
* URL: /api/v1/scan
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/delete_scan --data "hash=HashOfAPK" -H "Authorization:YourAPIKey"

=== App Scorecard ===

* Function: Get MobSF Application Security Scorecard.
* URL: /api/v1/scorecard
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/scorecard --data "hash=HashOfAPK" -H "Authorization:YourAPIKey"

=== Download PDF Report ===

* Function: API to generate PDF report.
* URL: /api/v1/download_pdf
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/download_pdf --data "hash=HashOfAPK" -H "Authorization:YourAPIKey"

=== Generate JSON Report ===

* Function: API to generate JSON report.
* URL: /api/v1/report_json
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/report_json --data "hash=HashOfAPK" -H "Authorization:YourAPIKey"

=== View Source Files ===

* Function: API to view source files.
* URL: /api/v1/view_source
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/view_source --data "hash=HashOfAPK&type=apk&file=b/a/a/a/a/a.java" -H "Authorization:YourAPIKey"

=== Compare Apps ===

* Function: API to compare scan results.
* URL: /api/v1/compare
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/compare --data "hash=HashOfAPK&hash2=HashOfOtherAPK" -H "Authorization:YourAPIKey"

=== Suppress by Rule ===

* Function: Suppress findings by rule id.
* URL: /api/v1/suppress_by_rule
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/suppress_by_rule --data "hash=HashOfAPK&type=manifest&rule=RuleYouWantToSuppress" -H "Authorization:YourAPIKey"

=== Suppress by Files ===

* Function: Suppress findings by files.
* URL: /api/v1/suppress_by_files
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/suppress_by_files --data "hash=HashOfAPK&type=code&rule=RuleYouWantToSuppress" -H "Authorization:YourAPIKey"

=== List Suppressions ===

* Function: View suppressions associated with a scan.
* URL: /api/v1/list_suppressions
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/list_suppressions --data "hash=HashOfAPK" -H "Authorization:YourAPIKey"

=== Delete Suppressions ===

* Function: Delete suppressions.
* URL: /api/v1/delete_suppression
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/list_suppressions --data "hash=HashOfAPK&kind=file&type=code&rule=RuleYouSuppressed" -H "Authorization:YourAPIKey"

== Use Cases ==

=== CI/CD Integration ===

* Description: Automatically analyize mobile applications during the build process, in order to catch security issues before application deployment.
* Implementation: Include MobSF API calls into the CI/CD pipeline to carry out scans automatically. Retrieve and parse the reults to determine if the build passes all required security criteria.
* Benefits: Every build is checked for scurity flaws, therefore reducing the risk of deploying vulnerable applications.

=== Scheduled Scans ===

* Description: Perform regular security scans on mobile applications to ensure they remain secure over time after deployment.
* Implementation: Set up cron jobs or scheduled tasks that use the MobSF API to scan at regular intervals. Collect and review the reports to see if new vulnerabilities apper.
* Benefits: Maintains security assessment over time, helping to detect and mitigate vulnerabilities introduced with updates or changes in the threat landscape.

=== Bulk analysis ===

* Description: Automate the analysis of multiple applications.
* Implementation: Develop scripts that use the MobSF API to queue and process multiple applications at once, collecting and comparing the results.
* Benefits: Manages the security assessment of portfolios of applications, making sure all of them are constantly evaluated and remain secure.

== Example Code ==

This is a simple example of automation of static Analysis in MobSF. It uploads a file, scans this file, and locally creates a pdf report of the static analysis of the APK.
<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Important</b>: Make sure to input your API Key before using the script.</div>

import sys
import os
import json
import requests
from requests_toolbelt.multipart.encoder import MultipartEncoder
# -----------------
SERVER = "http://127.0.0.1:8000"
APIKEY = '266ffc5f22d163c20aea506e9c54a67d8517a4f0e2fc868938080bd9c96b03e6'
# -----------------
def upload(file_path):
"""Upload File"""
print("Uploading file:", file_path)
multipart_data = MultipartEncoder(fields={'file': (os.path.basename(file_path), open(file_path, 'rb'), 'application/octet-stream')})
headers = {
'Content-Type': multipart_data.content_type,
'Authorization': APIKEY
}
print("Headers for upload:", headers) # Debugging line to check headers
response = requests.post(SERVER + '/api/v1/upload', data=multipart_data, headers=headers)
print("Upload response:", response.text)
return response.json()
# -----------------
def scan(upload_response):
"""Scan the file"""
print("Scanning file")
post_dict = {'hash': upload_response['hash']}
headers = {'Authorization': APIKEY}
response = requests.post(SERVER + '/api/v1/scan', data=post_dict, headers=headers)
print("Scan response:", response.text)
return upload_response['hash']
# -----------------
def pdf(file_hash):
"""Generate PDF Report"""
print("Generate PDF report")
headers = {'Authorization': APIKEY}
data = {"hash": file_hash}
response = requests.post(SERVER + '/api/v1/download_pdf', data=data, headers=headers, stream=True)
with open("report.pdf", 'wb') as flip:
for chunk in response.iter_content(chunk_size=1024):
if chunk:
flip.write(chunk)
print("Report saved as report.pdf")
# -----------------
if __name__ == "__main__":
if len(sys.argv) != 2:
print("Usage: python script_name.py <apk_file>")
sys.exit(1)
apk_file_path = sys.argv[1]
# -----------------
if not os.path.isfile(apk_file_path) or not apk_file_path.endswith(".apk"):
print("Invalid APK file:", apk_file_path)
sys.exit(1)
upload_response = upload(apk_file_path)
# -----------------
if 'hash' not in upload_response:
print("Failed to upload the APK file. Response:", upload_response)
sys.exit(1)
# -----------------
file_hash = scan(upload_response)
pdf(file_hash)

The script can be executed as follows:

python "ScriptName" "PathToAPK"

== References ==

* https://mobsf.live/api_docs

[[Category:Documentation]]

Mobile Security: Automation of APK Analysis with MobSF

2024-06-20T17:39:25Z

MKerndl: Added example code

== Summary ==

This article explores the automation of the Mobile Security Framework MobSF using its API, highlighting key features of the automation of static analysis as well as discussing practical use cases to demonstrate how MobSF automation enhances mobile security.

== Mobile Security Framework ==

Mobile Security Framework (MobSF) is an all-in mobile application pentesting tool. It is capable of performing static and dynamic analyses of APKs and is widely used for analyzing Android and IOS mobile applications.

== Automation of static analysis ==

Static analysis in MobSF can be automated using a script, implementing one of the numerous different API endpoints, which offer a wide range of functionalities.

=== Upload a File ===

* Function: API to upload a file. Supported file types are apk, zip, ipa and appx.
* URL: /api/v1/upload
* Sample Call:
curl -F 'file=@/Users/YourUser/Desktop/base.apk' http://localhost:8000/api/v1/upload -H "Authorization:YourAPIKey"

=== Scan a File ===

* Function: API to scan a file that is already uploaded. Supports scanning apk, xapk, apks, jar, aar, zip, ipa, so, dylib, a, and appx extensions.
* URL: /api/v1/scan
* Sample Call:
curl -F 'file=@/Users/YourUser/Desktop/base.apk' http://localhost:8000/api/v1/scan -H "Authorization:YourAPIKey"

=== Display Recent Scans ===

* Function: API to display recent scans.
* URL: /api/v1/scans
* Sample Call:
curl --url "http://localhost:8000/api/v1/scans" -H "Authorization:YourAPIKey"

=== Delete a Scan ===

* Function: API to scan a file that is already uploaded. Supports scanning apk, xapk, apks, jar, aar, zip, ipa, so, dylib, a, and appx extensions.
* URL: /api/v1/scan
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/delete_scan --data "hash=HashOfAPK" -H "Authorization:YourAPIKey"

=== App Scorecard ===

* Function: Get MobSF Application Security Scorecard.
* URL: /api/v1/scorecard
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/scorecard --data "hash=HashOfAPK" -H "Authorization:YourAPIKey"

=== Download PDF Report ===

* Function: API to generate PDF report.
* URL: /api/v1/download_pdf
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/download_pdf --data "hash=HashOfAPK" -H "Authorization:YourAPIKey"

=== Generate JSON Report ===

* Function: API to generate JSON report.
* URL: /api/v1/report_json
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/report_json --data "hash=HashOfAPK" -H "Authorization:YourAPIKey"

=== View Source Files ===

* Function: API to view source files.
* URL: /api/v1/view_source
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/view_source --data "hash=HashOfAPK&type=apk&file=b/a/a/a/a/a.java" -H "Authorization:YourAPIKey"

=== Compare Apps ===

* Function: API to compare scan results.
* URL: /api/v1/compare
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/compare --data "hash=HashOfAPK&hash2=HashOfOtherAPK" -H "Authorization:YourAPIKey"

=== Suppress by Rule ===

* Function: Suppress findings by rule id.
* URL: /api/v1/suppress_by_rule
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/suppress_by_rule --data "hash=HashOfAPK&type=manifest&rule=RuleYouWantToSuppress" -H "Authorization:YourAPIKey"

=== Suppress by Files ===

* Function: Suppress findings by files.
* URL: /api/v1/suppress_by_files
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/suppress_by_files --data "hash=HashOfAPK&type=code&rule=RuleYouWantToSuppress" -H "Authorization:YourAPIKey"

=== List Suppressions ===

* Function: View suppressions associated with a scan.
* URL: /api/v1/list_suppressions
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/list_suppressions --data "hash=HashOfAPK" -H "Authorization:YourAPIKey"

=== Delete Suppressions ===

* Function: Delete suppressions.
* URL: /api/v1/delete_suppression
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/list_suppressions --data "hash=HashOfAPK&kind=file&type=code&rule=RuleYouSuppressed" -H "Authorization:YourAPIKey"

== Use Cases ==

=== CI/CD Integration ===

* Description: Automatically analyize mobile applications during the build process, in order to catch security issues before application deployment.
* Implementation: Include MobSF API calls into the CI/CD pipeline to carry out scans automatically. Retrieve and parse the reults to determine if the build passes all required security criteria.
* Benefits: Every build is checked for scurity flaws, therefore reducing the risk of deploying vulnerable applications.

=== Scheduled Scans ===

* Description: Perform regular security scans on mobile applications to ensure they remain secure over time after deployment.
* Implementation: Set up cron jobs or scheduled tasks that use the MobSF API to scan at regular intervals. Collect and review the reports to see if new vulnerabilities apper.
* Benefits: Maintains security assessment over time, helping to detect and mitigate vulnerabilities introduced with updates or changes in the threat landscape.

=== Bulk analysis ===

* Description: Automate the analysis of multiple applications.
* Implementation: Develop scripts that use the MobSF API to queue and process multiple applications at once, collecting and comparing the results.
* Benefits: Manages the security assessment of portfolios of applications, making sure all of them are constantly evaluated and remain secure.

== Example Code ==

This is a simple example of automation of static Analysis in MobSF. It uploads a file, scans this file, and finally locally creates a pdf report.
<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Important</b>: Make sure to input your API Key before using the script.</div>

import sys
import os
import json
import requests
from requests_toolbelt.multipart.encoder import MultipartEncoder
# -----------------
SERVER = "http://127.0.0.1:8000"
APIKEY = '266ffc5f22d163c20aea506e9c54a67d8517a4f0e2fc868938080bd9c96b03e6'
# -----------------
def upload(file_path):
"""Upload File"""
print("Uploading file:", file_path)
multipart_data = MultipartEncoder(fields={'file': (os.path.basename(file_path), open(file_path, 'rb'), 'application/octet-stream')})
headers = {
'Content-Type': multipart_data.content_type,
'Authorization': APIKEY
}
print("Headers for upload:", headers) # Debugging line to check headers
response = requests.post(SERVER + '/api/v1/upload', data=multipart_data, headers=headers)
print("Upload response:", response.text)
return response.json()
# -----------------
def scan(upload_response):
"""Scan the file"""
print("Scanning file")
post_dict = {'hash': upload_response['hash']}
headers = {'Authorization': APIKEY}
response = requests.post(SERVER + '/api/v1/scan', data=post_dict, headers=headers)
print("Scan response:", response.text)
return upload_response['hash']
# -----------------
def pdf(file_hash):
"""Generate PDF Report"""
print("Generate PDF report")
headers = {'Authorization': APIKEY}
data = {"hash": file_hash}
response = requests.post(SERVER + '/api/v1/download_pdf', data=data, headers=headers, stream=True)
with open("report.pdf", 'wb') as flip:
for chunk in response.iter_content(chunk_size=1024):
if chunk:
flip.write(chunk)
print("Report saved as report.pdf")
# -----------------
if __name__ == "__main__":
if len(sys.argv) != 2:
print("Usage: python script_name.py <apk_file>")
sys.exit(1)
apk_file_path = sys.argv[1]
# -----------------
if not os.path.isfile(apk_file_path) or not apk_file_path.endswith(".apk"):
print("Invalid APK file:", apk_file_path)
sys.exit(1)
upload_response = upload(apk_file_path)
# -----------------
if 'hash' not in upload_response:
print("Failed to upload the APK file. Response:", upload_response)
sys.exit(1)
# -----------------
file_hash = scan(upload_response)
pdf(file_hash)

The script can be executed as follows:

python "ScriptName" "PathToAPK"

== References ==

* https://mobsf.live/api_docs

[[Category:Documentation]]

Mobile Security: Automation of APK Analysis with MobSF

2024-06-20T17:34:40Z

MKerndl: /* Delete Suppressionsle */

== Summary ==

This article explores the automation of the Mobile Security Framework MobSF using its API, highlighting key features of the automation of static analysis as well as discussing practical use cases to demonstrate how MobSF automation enhances mobile security.

== Mobile Security Framework ==

Mobile Security Framework (MobSF) is an all-in mobile application pentesting tool. It is capable of performing static and dynamic analyses of APKs and is widely used for analyzing Android and IOS mobile applications.

== Automation of static analysis ==

Static analysis in MobSF can be automated using a script, implementing one of the numerous different API endpoints, which offer a wide range of functionalities.

=== Upload a File ===

* Function: API to upload a file. Supported file types are apk, zip, ipa and appx.
* URL: /api/v1/upload
* Sample Call:
curl -F 'file=@/Users/YourUser/Desktop/base.apk' http://localhost:8000/api/v1/upload -H "Authorization:YourAPIKey"

=== Scan a File ===

* Function: API to scan a file that is already uploaded. Supports scanning apk, xapk, apks, jar, aar, zip, ipa, so, dylib, a, and appx extensions.
* URL: /api/v1/scan
* Sample Call:
curl -F 'file=@/Users/YourUser/Desktop/base.apk' http://localhost:8000/api/v1/scan -H "Authorization:YourAPIKey"

=== Display Recent Scans ===

* Function: API to display recent scans.
* URL: /api/v1/scans
* Sample Call:
curl --url "http://localhost:8000/api/v1/scans" -H "Authorization:YourAPIKey"

=== Delete a Scan ===

* Function: API to scan a file that is already uploaded. Supports scanning apk, xapk, apks, jar, aar, zip, ipa, so, dylib, a, and appx extensions.
* URL: /api/v1/scan
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/delete_scan --data "hash=HashOfAPK" -H "Authorization:YourAPIKey"

=== App Scorecard ===

* Function: Get MobSF Application Security Scorecard.
* URL: /api/v1/scorecard
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/scorecard --data "hash=HashOfAPK" -H "Authorization:YourAPIKey"

=== Download PDF Report ===

* Function: API to generate PDF report.
* URL: /api/v1/download_pdf
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/download_pdf --data "hash=HashOfAPK" -H "Authorization:YourAPIKey"

=== Generate JSON Report ===

* Function: API to generate JSON report.
* URL: /api/v1/report_json
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/report_json --data "hash=HashOfAPK" -H "Authorization:YourAPIKey"

=== View Source Files ===

* Function: API to view source files.
* URL: /api/v1/view_source
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/view_source --data "hash=HashOfAPK&type=apk&file=b/a/a/a/a/a.java" -H "Authorization:YourAPIKey"

=== Compare Apps ===

* Function: API to compare scan results.
* URL: /api/v1/compare
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/compare --data "hash=HashOfAPK&hash2=HashOfOtherAPK" -H "Authorization:YourAPIKey"

=== Suppress by Rule ===

* Function: Suppress findings by rule id.
* URL: /api/v1/suppress_by_rule
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/suppress_by_rule --data "hash=HashOfAPK&type=manifest&rule=RuleYouWantToSuppress" -H "Authorization:YourAPIKey"

=== Suppress by Files ===

* Function: Suppress findings by files.
* URL: /api/v1/suppress_by_files
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/suppress_by_files --data "hash=HashOfAPK&type=code&rule=RuleYouWantToSuppress" -H "Authorization:YourAPIKey"

=== List Suppressions ===

* Function: View suppressions associated with a scan.
* URL: /api/v1/list_suppressions
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/list_suppressions --data "hash=HashOfAPK" -H "Authorization:YourAPIKey"

=== Delete Suppressions ===

* Function: Delete suppressions.
* URL: /api/v1/delete_suppression
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/list_suppressions --data "hash=HashOfAPK&kind=file&type=code&rule=RuleYouSuppressed" -H "Authorization:YourAPIKey"

== Use Cases ==

=== CI/CD Integration ===

* Description: Automatically analyize mobile applications during the build process, in order to catch security issues before application deployment.
* Implementation: Include MobSF API calls into the CI/CD pipeline to carry out scans automatically. Retrieve and parse the reults to determine if the build passes all required security criteria.
* Benefits: Every build is checked for scurity flaws, therefore reducing the risk of deploying vulnerable applications.

=== Scheduled Scans ===

* Description: Perform regular security scans on mobile applications to ensure they remain secure over time after deployment.
* Implementation: Set up cron jobs or scheduled tasks that use the MobSF API to scan at regular intervals. Collect and review the reports to see if new vulnerabilities apper.
* Benefits: Maintains security assessment over time, helping to detect and mitigate vulnerabilities introduced with updates or changes in the threat landscape.

=== Bulk analysis ===

* Description: Automate the analysis of multiple applications.
* Implementation: Develop scripts that use the MobSF API to queue and process multiple applications at once, collecting and comparing the results.
* Benefits: Manages the security assessment of portfolios of applications, making sure all of them are constantly evaluated and remain secure.

== Example Code ==

This is a simple example of automation of static Analysis in MobSF. It uploads a file, scans this file, and finally locally creates a pdf report.
<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Important</b>: Make sure to input your API Key before using the script.</div>

insert code

The script can be executed as follows:

python "ScriptName" "PathToAPK"

== References ==

* https://mobsf.live/api_docs

[[Category:Documentation]]

Mobile Security: Automation of APK Analysis with MobSF

2024-06-20T17:34:15Z

MKerndl: /* Automation of static analysis */

== Summary ==

This article explores the automation of the Mobile Security Framework MobSF using its API, highlighting key features of the automation of static analysis as well as discussing practical use cases to demonstrate how MobSF automation enhances mobile security.

== Mobile Security Framework ==

Mobile Security Framework (MobSF) is an all-in mobile application pentesting tool. It is capable of performing static and dynamic analyses of APKs and is widely used for analyzing Android and IOS mobile applications.

== Automation of static analysis ==

Static analysis in MobSF can be automated using a script, implementing one of the numerous different API endpoints, which offer a wide range of functionalities.

=== Upload a File ===

* Function: API to upload a file. Supported file types are apk, zip, ipa and appx.
* URL: /api/v1/upload
* Sample Call:
curl -F 'file=@/Users/YourUser/Desktop/base.apk' http://localhost:8000/api/v1/upload -H "Authorization:YourAPIKey"

=== Scan a File ===

* Function: API to scan a file that is already uploaded. Supports scanning apk, xapk, apks, jar, aar, zip, ipa, so, dylib, a, and appx extensions.
* URL: /api/v1/scan
* Sample Call:
curl -F 'file=@/Users/YourUser/Desktop/base.apk' http://localhost:8000/api/v1/scan -H "Authorization:YourAPIKey"

=== Display Recent Scans ===

* Function: API to display recent scans.
* URL: /api/v1/scans
* Sample Call:
curl --url "http://localhost:8000/api/v1/scans" -H "Authorization:YourAPIKey"

=== Delete a Scan ===

* Function: API to scan a file that is already uploaded. Supports scanning apk, xapk, apks, jar, aar, zip, ipa, so, dylib, a, and appx extensions.
* URL: /api/v1/scan
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/delete_scan --data "hash=HashOfAPK" -H "Authorization:YourAPIKey"

=== App Scorecard ===

* Function: Get MobSF Application Security Scorecard.
* URL: /api/v1/scorecard
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/scorecard --data "hash=HashOfAPK" -H "Authorization:YourAPIKey"

=== Download PDF Report ===

* Function: API to generate PDF report.
* URL: /api/v1/download_pdf
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/download_pdf --data "hash=HashOfAPK" -H "Authorization:YourAPIKey"

=== Generate JSON Report ===

* Function: API to generate JSON report.
* URL: /api/v1/report_json
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/report_json --data "hash=HashOfAPK" -H "Authorization:YourAPIKey"

=== View Source Files ===

* Function: API to view source files.
* URL: /api/v1/view_source
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/view_source --data "hash=HashOfAPK&type=apk&file=b/a/a/a/a/a.java" -H "Authorization:YourAPIKey"

=== Compare Apps ===

* Function: API to compare scan results.
* URL: /api/v1/compare
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/compare --data "hash=HashOfAPK&hash2=HashOfOtherAPK" -H "Authorization:YourAPIKey"

=== Suppress by Rule ===

* Function: Suppress findings by rule id.
* URL: /api/v1/suppress_by_rule
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/suppress_by_rule --data "hash=HashOfAPK&type=manifest&rule=RuleYouWantToSuppress" -H "Authorization:YourAPIKey"

=== Suppress by Files ===

* Function: Suppress findings by files.
* URL: /api/v1/suppress_by_files
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/suppress_by_files --data "hash=HashOfAPK&type=code&rule=RuleYouWantToSuppress" -H "Authorization:YourAPIKey"

=== List Suppressions ===

* Function: View suppressions associated with a scan.
* URL: /api/v1/list_suppressions
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/list_suppressions --data "hash=HashOfAPK" -H "Authorization:YourAPIKey"

=== Delete Suppressionsle ===

* Function: Delete suppressions.
* URL: /api/v1/delete_suppression
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/list_suppressions --data "hash=HashOfAPK&kind=file&type=code&rule=RuleYouSuppressed" -H "Authorization:YourAPIKey"

== Use Cases ==

=== CI/CD Integration ===

* Description: Automatically analyize mobile applications during the build process, in order to catch security issues before application deployment.
* Implementation: Include MobSF API calls into the CI/CD pipeline to carry out scans automatically. Retrieve and parse the reults to determine if the build passes all required security criteria.
* Benefits: Every build is checked for scurity flaws, therefore reducing the risk of deploying vulnerable applications.

=== Scheduled Scans ===

* Description: Perform regular security scans on mobile applications to ensure they remain secure over time after deployment.
* Implementation: Set up cron jobs or scheduled tasks that use the MobSF API to scan at regular intervals. Collect and review the reports to see if new vulnerabilities apper.
* Benefits: Maintains security assessment over time, helping to detect and mitigate vulnerabilities introduced with updates or changes in the threat landscape.

=== Bulk analysis ===

* Description: Automate the analysis of multiple applications.
* Implementation: Develop scripts that use the MobSF API to queue and process multiple applications at once, collecting and comparing the results.
* Benefits: Manages the security assessment of portfolios of applications, making sure all of them are constantly evaluated and remain secure.

== Example Code ==

This is a simple example of automation of static Analysis in MobSF. It uploads a file, scans this file, and finally locally creates a pdf report.
<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Important</b>: Make sure to input your API Key before using the script.</div>

insert code

The script can be executed as follows:

python "ScriptName" "PathToAPK"

== References ==

* https://mobsf.live/api_docs

[[Category:Documentation]]

Mobile Security: Automation of APK Analysis with MobSF

2024-06-20T17:34:03Z

MKerndl: /* Automation of static analysis */

== Summary ==

This article explores the automation of the Mobile Security Framework MobSF using its API, highlighting key features of the automation of static analysis as well as discussing practical use cases to demonstrate how MobSF automation enhances mobile security.

== Mobile Security Framework ==

Mobile Security Framework (MobSF) is an all-in mobile application pentesting tool. It is capable of performing static and dynamic analyses of APKs and is widely used for analyzing Android and IOS mobile applications.

== Automation of static analysis ==

Static analysis in MobSF can be automated using a script, implementing one of the numerous different API endpoints. which offer a wide range of functionalities.

=== Upload a File ===

* Function: API to upload a file. Supported file types are apk, zip, ipa and appx.
* URL: /api/v1/upload
* Sample Call:
curl -F 'file=@/Users/YourUser/Desktop/base.apk' http://localhost:8000/api/v1/upload -H "Authorization:YourAPIKey"

=== Scan a File ===

* Function: API to scan a file that is already uploaded. Supports scanning apk, xapk, apks, jar, aar, zip, ipa, so, dylib, a, and appx extensions.
* URL: /api/v1/scan
* Sample Call:
curl -F 'file=@/Users/YourUser/Desktop/base.apk' http://localhost:8000/api/v1/scan -H "Authorization:YourAPIKey"

=== Display Recent Scans ===

* Function: API to display recent scans.
* URL: /api/v1/scans
* Sample Call:
curl --url "http://localhost:8000/api/v1/scans" -H "Authorization:YourAPIKey"

=== Delete a Scan ===

* Function: API to scan a file that is already uploaded. Supports scanning apk, xapk, apks, jar, aar, zip, ipa, so, dylib, a, and appx extensions.
* URL: /api/v1/scan
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/delete_scan --data "hash=HashOfAPK" -H "Authorization:YourAPIKey"

=== App Scorecard ===

* Function: Get MobSF Application Security Scorecard.
* URL: /api/v1/scorecard
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/scorecard --data "hash=HashOfAPK" -H "Authorization:YourAPIKey"

=== Download PDF Report ===

* Function: API to generate PDF report.
* URL: /api/v1/download_pdf
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/download_pdf --data "hash=HashOfAPK" -H "Authorization:YourAPIKey"

=== Generate JSON Report ===

* Function: API to generate JSON report.
* URL: /api/v1/report_json
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/report_json --data "hash=HashOfAPK" -H "Authorization:YourAPIKey"

=== View Source Files ===

* Function: API to view source files.
* URL: /api/v1/view_source
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/view_source --data "hash=HashOfAPK&type=apk&file=b/a/a/a/a/a.java" -H "Authorization:YourAPIKey"

=== Compare Apps ===

* Function: API to compare scan results.
* URL: /api/v1/compare
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/compare --data "hash=HashOfAPK&hash2=HashOfOtherAPK" -H "Authorization:YourAPIKey"

=== Suppress by Rule ===

* Function: Suppress findings by rule id.
* URL: /api/v1/suppress_by_rule
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/suppress_by_rule --data "hash=HashOfAPK&type=manifest&rule=RuleYouWantToSuppress" -H "Authorization:YourAPIKey"

=== Suppress by Files ===

* Function: Suppress findings by files.
* URL: /api/v1/suppress_by_files
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/suppress_by_files --data "hash=HashOfAPK&type=code&rule=RuleYouWantToSuppress" -H "Authorization:YourAPIKey"

=== List Suppressions ===

* Function: View suppressions associated with a scan.
* URL: /api/v1/list_suppressions
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/list_suppressions --data "hash=HashOfAPK" -H "Authorization:YourAPIKey"

=== Delete Suppressionsle ===

* Function: Delete suppressions.
* URL: /api/v1/delete_suppression
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/list_suppressions --data "hash=HashOfAPK&kind=file&type=code&rule=RuleYouSuppressed" -H "Authorization:YourAPIKey"

== Use Cases ==

=== CI/CD Integration ===

* Description: Automatically analyize mobile applications during the build process, in order to catch security issues before application deployment.
* Implementation: Include MobSF API calls into the CI/CD pipeline to carry out scans automatically. Retrieve and parse the reults to determine if the build passes all required security criteria.
* Benefits: Every build is checked for scurity flaws, therefore reducing the risk of deploying vulnerable applications.

=== Scheduled Scans ===

* Description: Perform regular security scans on mobile applications to ensure they remain secure over time after deployment.
* Implementation: Set up cron jobs or scheduled tasks that use the MobSF API to scan at regular intervals. Collect and review the reports to see if new vulnerabilities apper.
* Benefits: Maintains security assessment over time, helping to detect and mitigate vulnerabilities introduced with updates or changes in the threat landscape.

=== Bulk analysis ===

* Description: Automate the analysis of multiple applications.
* Implementation: Develop scripts that use the MobSF API to queue and process multiple applications at once, collecting and comparing the results.
* Benefits: Manages the security assessment of portfolios of applications, making sure all of them are constantly evaluated and remain secure.

== Example Code ==

This is a simple example of automation of static Analysis in MobSF. It uploads a file, scans this file, and finally locally creates a pdf report.
<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Important</b>: Make sure to input your API Key before using the script.</div>

insert code

The script can be executed as follows:

python "ScriptName" "PathToAPK"

== References ==

* https://mobsf.live/api_docs

[[Category:Documentation]]

Mobile Security: Automation of APK Analysis with MobSF

2024-06-20T14:29:12Z

MKerndl: This article explores the automation of the Mobile Security Framework MobSF using its API, highlighting key features of the automation of static analysis as well as discussing practical use cases to demonstrate how MobSF automation enhances mobile security.

== Summary ==

This article explores the automation of the Mobile Security Framework MobSF using its API, highlighting key features of the automation of static analysis as well as discussing practical use cases to demonstrate how MobSF automation enhances mobile security.

== Mobile Security Framework ==

Mobile Security Framework (MobSF) is an all-in mobile application pentesting tool. It is capable of performing static and dynamic analyses of APKs and is widely used for analyzing Android and IOS mobile applications.

== Automation of static analysis ==

Static analysis in MobSF can be automated through its API and offers a wide range of functionalities.

=== Upload a File ===

* Function: API to upload a file. Supported file types are apk, zip, ipa and appx.
* URL: /api/v1/upload
* Sample Call:
curl -F 'file=@/Users/YourUser/Desktop/base.apk' http://localhost:8000/api/v1/upload -H "Authorization:YourAPIKey"

=== Scan a File ===

* Function: API to scan a file that is already uploaded. Supports scanning apk, xapk, apks, jar, aar, zip, ipa, so, dylib, a, and appx extensions.
* URL: /api/v1/scan
* Sample Call:
curl -F 'file=@/Users/YourUser/Desktop/base.apk' http://localhost:8000/api/v1/scan -H "Authorization:YourAPIKey"

=== Display Recent Scans ===

* Function: API to display recent scans.
* URL: /api/v1/scans
* Sample Call:
curl --url "http://localhost:8000/api/v1/scans" -H "Authorization:YourAPIKey"

=== Delete a Scan ===

* Function: API to scan a file that is already uploaded. Supports scanning apk, xapk, apks, jar, aar, zip, ipa, so, dylib, a, and appx extensions.
* URL: /api/v1/scan
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/delete_scan --data "hash=HashOfAPK" -H "Authorization:YourAPIKey"

=== App Scorecard ===

* Function: Get MobSF Application Security Scorecard.
* URL: /api/v1/scorecard
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/scorecard --data "hash=HashOfAPK" -H "Authorization:YourAPIKey"

=== Download PDF Report ===

* Function: API to generate PDF report.
* URL: /api/v1/download_pdf
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/download_pdf --data "hash=HashOfAPK" -H "Authorization:YourAPIKey"

=== Generate JSON Report ===

* Function: API to generate JSON report.
* URL: /api/v1/report_json
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/report_json --data "hash=HashOfAPK" -H "Authorization:YourAPIKey"

=== View Source Files ===

* Function: API to view source files.
* URL: /api/v1/view_source
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/view_source --data "hash=HashOfAPK&type=apk&file=b/a/a/a/a/a.java" -H "Authorization:YourAPIKey"

=== Compare Apps ===

* Function: API to compare scan results.
* URL: /api/v1/compare
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/compare --data "hash=HashOfAPK&hash2=HashOfOtherAPK" -H "Authorization:YourAPIKey"

=== Suppress by Rule ===

* Function: Suppress findings by rule id.
* URL: /api/v1/suppress_by_rule
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/suppress_by_rule --data "hash=HashOfAPK&type=manifest&rule=RuleYouWantToSuppress" -H "Authorization:YourAPIKey"

=== Suppress by Files ===

* Function: Suppress findings by files.
* URL: /api/v1/suppress_by_files
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/suppress_by_files --data "hash=HashOfAPK&type=code&rule=RuleYouWantToSuppress" -H "Authorization:YourAPIKey"

=== List Suppressions ===

* Function: View suppressions associated with a scan.
* URL: /api/v1/list_suppressions
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/list_suppressions --data "hash=HashOfAPK" -H "Authorization:YourAPIKey"

=== Delete Suppressionsle ===

* Function: Delete suppressions.
* URL: /api/v1/delete_suppression
* Sample Call:
curl -X POST --url http://localhost:8000/api/v1/list_suppressions --data "hash=HashOfAPK&kind=file&type=code&rule=RuleYouSuppressed" -H "Authorization:YourAPIKey"

== Use Cases ==

=== CI/CD Integration ===

* Description: Automatically analyize mobile applications during the build process, in order to catch security issues before application deployment.
* Implementation: Include MobSF API calls into the CI/CD pipeline to carry out scans automatically. Retrieve and parse the reults to determine if the build passes all required security criteria.
* Benefits: Every build is checked for scurity flaws, therefore reducing the risk of deploying vulnerable applications.

=== Scheduled Scans ===

* Description: Perform regular security scans on mobile applications to ensure they remain secure over time after deployment.
* Implementation: Set up cron jobs or scheduled tasks that use the MobSF API to scan at regular intervals. Collect and review the reports to see if new vulnerabilities apper.
* Benefits: Maintains security assessment over time, helping to detect and mitigate vulnerabilities introduced with updates or changes in the threat landscape.

=== Bulk analysis ===

* Description: Automate the analysis of multiple applications.
* Implementation: Develop scripts that use the MobSF API to queue and process multiple applications at once, collecting and comparing the results.
* Benefits: Manages the security assessment of portfolios of applications, making sure all of them are constantly evaluated and remain secure.

== Example Code ==

This is a simple example of automation of static Analysis in MobSF. It uploads a file, scans this file, and finally locally creates a pdf report.
<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Important</b>: Make sure to input your API Key before using the script.</div>

insert code

The script can be executed as follows:

python "ScriptName" "PathToAPK"

== References ==

* https://mobsf.live/api_docs

[[Category:Documentation]]