performing-android-app-static-analysis-with-mobsf

# Performing Android App Static Analysis with MobSF ## When to Use Use this skill when: - Conducting security assessment of Android APK or AAB files before production release - Integrating automated mobile security scanning into CI/CD pipelines - Performing initial triage of Android applications during penetration testing engagements - Reviewing third-party Android applications for supply chain security risks **Do not use** this skill as a replacement for manual code review or dynamic analysis -- MobSF static analysis catches pattern-based vulnerabilities but misses runtime logic flaws. ## Prerequisites - MobSF v4.x installed via Docker (`docker pull opensecurity/mobile-security-framework-mobsf`) or local setup - Target Android APK, AAB, or source code ZIP - Python 3.10+ for MobSF REST API integration - JADX decompiler (bundled with MobSF) for Java/Kotlin source recovery - Network access to MobSF web interface (default: http://localhost:8000) ## Workflow ### Step 1: Deploy MobSF and Obtain API Key Launch MobSF using Docker for isolated, reproducible scanning: ```bash docker run -it --rm -p 8000:8000 opensecurity/mobile-security-framework-mobsf:latest ``` Retrieve the REST API key from the MobSF web interface at `http://localhost:8000/api_docs` or from the startup console output. The API key enables programmatic scanning. ### Step 2: Upload APK for Static Analysis Upload the target APK using the MobSF REST API: ```bash curl -F "file=@target_app.apk" http://localho...