MobSF/Mobile-Security-Framework-MobSF v4.6.2

on GitHub

v4.6.2 Changelog

This release adds dynamic analysis on physical Android devices, refreshes the web interface with a new home page and dark mode, and includes several security and performance improvements.

• Features or Enhancements

  • Added Android dynamic analysis on physical devices, with support for both rooted and stock (non-rooted) devices, plus documentation and hardened defaults for physical-device deployments
  • Added a Frida Gadget APK builder to instrument apps on stock devices, including support for split APK sets
  • Kept Gadget injection within Android's DEX limit and added uninstall for Gadget-injected apps
  • Added a gallery of installed apps on the connected Android device, with on-demand scanning
  • Added live step-by-step progress while Android dynamic analysis setup runs
  • Refreshed the home page and added a dark mode toggle to the AdminLTE shell
  • Added Dart string extraction from Flutter libapp.so
  • Added a check that flags unauthenticated LocalServerSocket listeners
  • Added analysis of native libraries inside split APKs
  • Skipped JetBrains and Flutter embedding classes during static analysis to reduce noise
  • Reduced Flutter false positives in secret detection by ignoring Flutter plugin constants and tightening binary secret detection
  • Cached App Link host SSRF verdicts so each host is checked and logged only once
  • Sped up report loading by fetching the report DB row once instead of once per field
  • security.py hardening and dependency updates
  • Removed the dead malwaredomainlist.com integration
  • Docker images are now published from the docker-publish environment; bumped docker/build-push-action to 7.4.0 and actions/setup-java to 6.1.0

• Bug Fixes

  • Bounded outbound requests driven by scanned app content
  • Kept APPX executable reads inside the upload directory
  • Stopped the OS unzip fallback from following external symlinks
  • Boolean settings are now treated as enabled only when set to 1
  • Fixed Frida Gadget spawn failures by freeing port 27042 and retrying on ProtocolError
  • Fixed a Docker entrypoint log-level typo so it matches run.sh
  • Fixed runserver when debugging

What's Changed

• fix: analyze native libraries from split APKs by @Zen1th53 in #2685
• Bump docker/build-push-action from 7.3.0 to 7.4.0 by @dependabot[bot] in #2688
• chore: remove dead malwaredomainlist.com integration by @alanhasn in #2687
• Keep APPX executable reads inside the upload directory by @ajinabraham in #2694
• Android dynamic analyzer: add physical-device foundation by @ajinabraham in #2698
• Android dynamic analyzer: support rooted physical devices by @ajinabraham in #2699
• Android dynamic analyzer: add Frida Gadget APK builder by @ajinabraham in #2700
• Android dynamic analyzer: support stock physical devices by @ajinabraham in #2701
• Document and harden Android physical-device deployments by @ajinabraham in #2702
• Android dynamic analyzer: support Gadget split APK sets by @ajinabraham in #2711
• Fix Docker entrypoint log-level typo to match run.sh by @cpuu in #2719
• Bump actions/setup-java from 6.0.1 to 6.1.0 by @dependabot[bot] in #2716
• fix: cache App Link host SSRF verdicts and log them once by @Antiksec in #2723
• Treat boolean settings as enabled only for 1 by @ajinabraham in #2724
• Fetch report DB row once instead of per field by @iamthana in #2713
• v4.6.0: security.py hardening, DB performance, dependency updates by @ajinabraham in #2725
• Show installed Android apps in a gallery and scan on demand by @ajinabraham in #2726
• [Fix] Fix runserver for PyCharm debug by @foundkey in #2535
• Keep the OS unzip fallback from following external symlinks by @ajinabraham in #2727
• Refresh the home page by @ajinabraham in #2728
• Add a dark mode toggle to the AdminLTE shell by @ajinabraham in #2729
• Show live Android dynamic analysis steps while setup runs by @ajinabraham in #2731
• Extract Dart strings from Flutter libapp.so by @captainrogers69 in #2730
• Publish Docker images from the docker-publish environment by @ajinabraham in #2732
• Skip JetBrains classes during static analysis by @ajinabraham in #2733
• Flag unauthenticated LocalServerSocket listeners by @ajinabraham in #2735
• Bound outbound requests driven by scanned app content by @ajinabraham in #2739
• Keep Gadget injection inside the DEX limit and add uninstall by @ajinabraham in #2738
• Skip Flutter embedding classes during static analysis by @captainrogers69 in #2736
• fix(android): free port 27042 and retry on ProtocolError during Frida Gadget spawn by @ajinabraham in #2741
• Ignore Flutter plugin constants in secret detection by @captainrogers69 in #2742
• Reduce Flutter false positives in binary secret detection. by @captainrogers69 in #2737

New Contributors

• @iamthana made their first contribution in #2713
• @foundkey made their first contribution in #2535
• @captainrogers69 made their first contribution in #2730

Full Changelog: v4.5.3...v4.6.2