Setting up MobSF in Ubuntu 18.04

By
Hi guys,

It's been a while since I last updated the blog. Been busy. So, for today I will be giving guide on how to setup MobSF in Ubuntu 18.04. There is a lot of guide out there about how to setup MobSF. I'm here to give out step by step guide to set it up as per my own experience. The main reason of using Ubuntu 18.04 is because it has a built-in Python 3.6 and pip3 version 9.0.1 which is the requirements to setup MobSF. It's pretty much simplify the process of setting up MobSF.

*Note that this is a guide to setup MobSF for static analysis. For dynamic analysis, you can refer to MobSF page in github.

MobSF also known as Mobile Security Framework is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing framework capable of performing static analysis, dynamic analysis, malware analysis and web API testing.

Can further read about MobSF here: https://github.com/MobSF/Mobile-Security-Framework-MobSF

For Ubuntu 18.04 can be downloaded here : https://ubuntu.com/download/desktop

Requirements:

1) Git, Python 3.6+, JDK 8+

Step by step guide is as per below:

1) After installing a fresh Ubuntu 18.04, install git.

Command : sudo apt-get install git

2) Do apt update

Command : sudo apt update


3) Install python3-pip

Command : sudo apt install python3-pip


4) Install jdk. Check version after installing to reconfirmed it.

Command : sudo apt install default-jre


5) Installing python package.

Command : sudo apt install python3-venv python3-pip python3-dev build-essential \
libffi-dev libssl-dev libxml2-dev libxslt1-dev libjpeg8-dev zlib1g-dev



6) Cloning MobSF

Command : git clone https://github.com/MobSF/Mobile-Security-Framework-MobSF.git


7) Running setup.sh. Wait for installation to complete. It will take sometime. Change to the MobSF directory.

Command : cd Mobile-Security-Framework-MobSF/

Command : ./setup.sh

8) Running MobSF

Command: ./run.sh


9) Navigate to http://localhost:8000 and you have successfully installed MobSF.



*Do note that this method works as of this date 19 September 2019. It might not work on a later date.

Now you can start to doing static analysis on mobile application.

Cheers.




Comments

  1. SamNovember 3, 2020 at 4:59 AM

    At Step 7, you switch to ~/Mobile-Security-Framework-MobSF directory, but you didn't mention it.
    Except this, everything is good (still in 2020 :-P ). Thanks for the tutorial.

    Sam Hamza

    ReplyDelete
    Replies
    1. FaudhzanNovember 6, 2020 at 12:59 AM

      Thanks for pointing it out. Will edit it. Glad it is helpful to others.

      Delete
    2. UnknownApril 28, 2021 at 2:29 PM

      It is already mention to change the directory by this command "cd Mobile-Security-Framework-MobSF/"
      and i m facing this error after step 7
      [ERROR] MobSF dependencies require Python 3.8/3.9. You have Python version 3.6.9 or python3 points to Python 3.6.9.


      Delete
  2. VintageNovember 19, 2020 at 11:13 PM

    Hi there, for some reason if I ./run.sh it can~t connect. It says 'retrying in 1 sec' several times and then can't connect to ...
    Can anyone help?

    ReplyDelete
  3. UnknownApril 22, 2021 at 1:32 AM

    Error: Command '['/root/Mobile-Security-Framework-MobSF/venv/bin/python3', '-Im', 'ensurepip', '--upgrade', '--default-pip']' returned non-zero exit status 1.
    [ERROR] Failed to create virtualenv. Please install MobSF requirements mentioned in Documentation.



    I encountered this error how to overcome this

    ReplyDelete
  4. UnknownApril 28, 2021 at 2:30 PM

    [ERROR] MobSF dependencies require Python 3.8/3.9. You have Python version 3.6.9 or python3 points to Python 3.6.9.
    I am facing this issue after step 7 can You please help

    ReplyDelete

Post a Comment

Popular posts from this blog

Petraware pTransformer ADC before 2.1.7.22827 allows SQL Injection via the User ID parameter to the login form.

By
Image
Hi All, Today I will share POC on vulnerability found during pentest. As per the title, I recently found SQL Injection vulnerability on a thick client.  To read more about thick client, click here :  https://techterms.com/definition/thickclient Thick clients, also called heavy clients, are full-featured computers that are connected to a network.  While a thick client is fully functional without a network connection, it is only a "client" when it is connected to a server. The server may provide the thick client with programs and files that are not stored on the local machine's hard drive.   Exploit Title:   Petraware pTransformer ADC before 2.1.7.22827 allows SQL Injection via the User ID parameter to the login form. Details & Description :   SQL injection is a vulnerability that allows an attacker to alter backend SQL statements by manipulating the user input. An SQL injection occurs when web applications accept user input that is directly placed into a SQL
Read more

Setting up RMS in Ubuntu 18.04

By
Image
Hi peeps, It's been a while since my last post. Been busy. So, for today I would like to share on how to setup RMS (Runtime Security Mobile) in Ubuntu 18.04. RMS -  https://github.com/m0bilesecurity/RMS-Runtime-Mobile-Security "Runtime Mobile Security (RMS), powered by FRIDA, is a powerful web interface that helps you to manipulate Android and iOS Apps at Runtime." "You can easily dump all the loaded classes and relative methods, hook everything on the fly, trace methods args and return value, load custom scripts and many other useful stuff." This is a continuation of my post here  https://faudhzanrahman.blogspot.com/2019/09/setting-up-mobsf-in-ubuntu-1804.html  where I did a setup on MobSF.  I'm currently trying to set a box where it contains all sort of testing tools specifically for mobile . Now I have both MobSF and RMS setup in this box which is the Ubuntu 18.04. The same reason of setting RMS in this box is because the requirements fits Ubuntu 18.04. T
Read more