Utilities
Scan Android source with local security rules
mobsfscan-source is an Android source-pattern scanning adapter using mobsfscan.
overview
What mobsfscan-source does
Review supplied Android Java, Kotlin and XML source with local mobsfscan rules. The input is a source folder, not an APK, installed application or connected device.
A FILE containing native mobsfscan JSON with results and errors. The adapter uses --no-fail so findings remain report data; nonzero native exit or reported errors fail the adapter. The accepted owned AES fixture triggered aes_ecb_mode_default and its AES/GCM counterpart removed that rule. Malformed XML is rejected by adapter preflight, not claimed as native validation. Heuristic metadata still requires review.
The source folder is limited to 200 files and 10 MiB of file content. Symlinks are refused, and at least one .java, .kt or .xml file is required. The adapter parses XML before scanning. Native execution has a 120-second timeout; the 4 MiB report limit is checked after execution and does not establish peak memory or disk containment.
Pinned upstream version: 1.0.1. Upstream license: LGPL-3.0; first-party adapter licensing is separate. Local native positive and negative fixtures passed. Native and platform fixtures, public Library identity and source/notices delivery were verified. The tested source recipe pins upstream-required Semgrep 1.172.0 and its dependency lock.
source github.com/MobSF/mobsfscan/tree/4645ea70bc093268502fe9f6df93e41bb482254a
use cases
Where mobsfscan-source fits
Inspect cryptographic patterns
Review source findings involving cipher configuration, with file and rule details when the native report provides them.
Compare a source correction
Check an owned source fixture and its corrected counterpart; only the tested rule and outcome can establish a regression result.
Retain static-review evidence
Save the native JSON for manual review without installing the app or testing a remote service.
reference
mobsfscan-source inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| source | FOLDER | --source | Folder of Android Java, Kotlin and XML source for local-rule analysis. |
Showing key inputs. mobsfscan-source exposes 1 inputs in total.
example
Run mobsfscan-source
python3 /app/run.py --source ./android-source ./output{
"errors": [],
"mobsfscan_version": "1.0.1",
"results": {
"aes_ecb_mode_default": {
"files": [
{
"file_path": "/input/source-positive/Fixture.java",
"match_lines": [
3,
3
],
"match_position": [
59,
84
],
"match_string": "class Fixture { Cipher cipher() throws Exception { return Cipher.getInstance(\"AES\"); } }"
}
],
"metadata": {
"cwe": "CWE-327: Use of a Broken or Risky Cryptographic Algorithm",
"description": "Calling Cipher.getInstance(\"AES\") will return AES ECB mode by default. ECB mode is known to be weak as it results in the same ciphertext for identical blocks of plaintext.",
"masvs": "MSTG-CRYPTO-2",
"owasp-mobile": "M5: Insufficient Cryptography",
"reference": "https://github.com/MobSF/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#weak-block-cipher-mode",
"severity": "ERROR"
}
},guidance
Choosing mobsfscan-source
Use this operation when you have Android source. JADX may provide reconstructed Java through a separate APK inspection job, but reconstructed code is not equivalent to the original project. APKiD identifies APK signatures instead of source security patterns.
faq
mobsfscan-source questions
related
More Utilities tools
browser-fetch
Headless Chromium render: requested URL, final URL, status, and title next to the page.
cewl
Spider a URL and return a wordlist for password crackers.
csvkit
SQL on one CSV. The table name is the file stem.
dnsgen
Wordlist and mined-word subdomain permutation.
duckdb
In-process SQL on CSV, JSON, and Parquet. No server.
edge-tts
Microsoft Edge neural speech from text or a script file. No API key.
Run mobsfscan-source yourself
Exact leading excerpt of retained native mobsfscan JSON from an owned Java fixture using Cipher.getInstance("AES"). It includes the aes_ecb_mode_default result; the remaining heuristic metadata is omitted, so this is not a complete JSON document. The AES/GCM counterpart removed that rule. Malformed XML was rejected by adapter preflight, not by the upstream scanner, which had returned zero. Input-root paths can differ between runs; preserve native output and validate the actual fixture/rule plus each run’s downloaded hash. Separate private platform fixture runs and exact public Library readbacks also passed.
Facts on this page come from the live Trickest tool library.