Integrate MobSF with Vulnetix. Run Mobile Security Framework via Docker to perform static and dynamic analysis on APK and IPA files, then export JSON findings for upload to Vulnetix.
Install & scan
$ docker pull opensecurity/mobile-security-framework-mobsf:latest
docker run -it --rm -p 8000:8000 opensecurity/mobile-security-framework-mobsf:latest
$ # Get API key from MobSF web UI homepage
API_KEY="your_api_key_here"
# Upload APK and run static analysis via REST API
FILE_HASH=$(curl -s -F "file=@app.apk" -H "Authorization: ${API_KEY}" http://localhost:8000/api/v1/upload | jq -r '.hash')
# Trigger scan
curl -s -F "hash=${FILE_HASH}" -H "Authorization: ${API_KEY}" http://localhost:8000/api/v1/scan
# Export JSON report
curl -s -H "Authorization: ${API_KEY}" "http://localhost:8000/api/v1/report_json?hash=${FILE_HASH}" -o mobsf-report.json
Run MobSF in CI
Scan on every push and upload the report as a workflow artifact:
- name: Start MobSF
run: |
docker run -d --name mobsf -p 8000:8000 opensecurity/mobile-security-framework-mobsf:latest
sleep 30
- name: Run MobSF scan
env:
MOBSF_API_KEY: ${{ secrets.MOBSF_API_KEY }}
run: |
HASH=$(curl -s -F "file=@app.apk" -H "Authorization: ${MOBSF_API_KEY}" http://localhost:8000/api/v1/upload | jq -r '.hash')
curl -s -F "hash=${HASH}" -H "Authorization: ${MOBSF_API_KEY}" http://localhost:8000/api/v1/scan
curl -s -H "Authorization: ${MOBSF_API_KEY}" "http://localhost:8000/api/v1/report_json?hash=${HASH}" -o mobsf-report.json
- name: Upload report
run: vulnetix upload --file mobsf-report.json
How Vulnetix compares: better together
Vulnetix does not replace MobSF. Keep running it. Vulnetix sits on top of MobSF (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.
MobSF is strongest at its core category and also carries features in SAST, DAST, Secret Scanning, SBOM Generation, just as Vulnetix spans categories.
| Capability | Vulnetix | MobSF |
|---|---|---|
| Security coverage | ||
| SAST (static code analysis) | ✓ Built-in rules + Semgrep augmentation | ✓ Static analyzer decompiles APK/AAB/IPA/source to review code paths, manifest, permissions and insecure code patterns |
| SCA / dependencies | ✓ 40+ ecosystems, transitive graph | ✗ |
| DAST (dynamic testing) | ~ Ingests DAST results; no native dynamic engine | ~ Frida-based dynamic analyzer runs the app for runtime behaviour, network traffic and API-call analysis (mobile-only) |
| Container & image | ✓ Image CVEs, base image, Dockerfile | ✗ |
| IaC / misconfiguration | ✓ Terraform, k8s, CloudFormation | ✗ |
| Secret scanning | ✓ 1,000+ rules, source + binary + git history | ~ Static analysis flags hardcoded credentials and API keys in the binary |
| Cloud / CSPM | ✓ Cloud-posture findings, compliance tab | ✗ |
| Mobile (MAST) | ~ Ingests mobile scanner output; no native mobile engine | ✓ Core: mobile app pen-testing/security assessment for Android/iOS/Windows via static + dynamic analysis |
| License compliance | ✓ SPDX, copyleft/AGPL/SSPL policy | ✗ |
| SBOM generation | ✓ CycloneDX 1.7 + SPDX 2.3, cosign-signable | ~ Surfaces every third-party SDK/embedded native library with detected version, closest thing to a mobile-app SBOM, not a signed CycloneDX/SPDX document |
| Malware / supply-chain | ✓ De-duplicated corpus + install-time firewall (25+ registries) | ~ Dedicated malware-analysis component pattern-matches known malicious behaviours and IOCs in the app binary (app-level, not supply-chain registry firewall) |
| Network / infra vuln | ~ Ingests network scanner output; no native network scanner | ✗ |
| Fuzzing | ✗ Ingests fuzzing crashes; no native fuzzer | ✗ |
| Pentest / bug bounty | ✗ Ingests pentest/bug-bounty findings; not a testing service | ✗ |
| The Vulnetix orchestration layer | ||
| Cross-scanner dedup & one queue (ASPM) | ✓ Correlates every scanner into one prioritised queue with ownership routing | ✗ |
| Exploit-intel prioritisation | ✓ EPSS, CISA KEV, Coalition ESS, CWSS, Vulnetix LEV | ✗ |
| Reachability analysis | ✓ Tree-sitter + CVEAffected; direct/transitive/semantic | ✗ |
| Versioned VEX + audit trail | ✓ Immutable OpenVEX/CycloneDX, cosign-signable | ✗ |
| Safe Harbour autofix | ✓ Resolves + applies the nearest safe version | ✗ |
| End-of-life policy | ✓ Flags/blocks past-EOL runtimes & packages | ✗ |
| SSVC / risk-based policy | ✓ SSVC v2 + CISA/FedRAMP/Essential-8 presets | ✗ |
✓ full · ~ partial · ✗ not covered
What MobSF does well
- The de facto open-source all-in-one mobile app security framework: static + dynamic + malware analysis for Android (APK/AAB), iOS (IPA) and Windows binaries plus source
- Static analysis decompiles binaries to review code paths, dangerous permissions, hardcoded secrets/API keys and third-party SDKs
- Frida-backed dynamic analyzer for interactive instrumented runtime testing, network-traffic capture and API-call inspection on Android/iOS
- REST API and CLI for CI/CD integration, free and self-hostable
Where Vulnetix adds to it: Vulnetix has no MAST/mobile engine and does not run MobSF's static or Frida dynamic analysis. It ingests and orchestrates MobSF output. MobSF lists a binary's SDKs but does not do CVE/SCA matching, prioritisation or VEX; Vulnetix takes those findings into a cross-scanner prioritised queue, adds EPSS/KEV/LEV exploit-intel, EOL policy, SSVC, immutable versioned VEX and Safe Harbour autofix, and cross-references the third-party libraries MobSF surfaces against its vulnerability DB, turning MobSF's mobile findings into governed, deduped, remediable work items alongside every other scanner.
No migration, no rip-and-replace. MobSF keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.
Centralise MobSF results in Vulnetix
Upload MobSF JSON, PDF output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.