Mobile App Security Testing Tools: MobSF and Apktool

Short answer: MobSF (Mobile Security Framework) is an automated static and dynamic analysis platform for Android, iOS, and Windows apps that produces a scored security report in minutes. Apktool is the standard APK decompiler and repackager used for manual manifest inspection, resource extraction, and APK patching. Every Android security assessment starts with both.

TL;DR: Run MobSF first for an automated baseline — it takes under 10 minutes and catches the obvious issues. Then use Apktool and jadx for manual review of what the scanner cannot interpret. Together they cover the full static analysis phase of an Android penetration testing methodology.

Key Takeaways - MobSF is open-source, has 21,000+ GitHub stars, and its static analyzer achieves a vendor-reported 97% detection rate (MobSF GitHub) for common mobile vulnerability patterns. - Apktool decodes the APK into human-readable resources — smali bytecode, XML manifests, and raw assets — that MobSF's automated scan does not expose directly. - Always verify automated findings manually — scanners produce false positives, and business-logic issues require human review. - Neither tool replaces dynamic analysis; use them as the static analysis foundation before moving to Frida and Burp Suite. - 92% of analyzed mobile work apps use weak or flawed cryptographic methods (Infosecurity Magazine) — static tools catch most of these before a device is ever connected.

If you are new to mobile security testing, start with the beginner's guide to mobile app penetration testing.

Understanding the role of each tool

Before installing anything, it helps to understand what each tool actually does and where it fits in the workflow.

MobSF wraps several of these under one roof for automated scanning. Apktool gives you raw, reconstructed app structure for manual inspection. Both are essential; they serve different parts of the assessment.

MobSF — Mobile Security Framework

What MobSF does

MobSF performs automated security analysis of: - Android APKs — static analysis, permissions, manifest, code scanning, and dynamic analysis - iOS IPAs — static analysis, binary analysis, plist inspection - Windows apps — basic static analysis

Its static engine decompiles the APK, extracts and reads the manifest, scans decompiled code for dangerous patterns (hardcoded secrets, weak crypto, exported components), checks binary protection features (code signing, anti-tampering), and assigns a security score.

MobSF's dynamic engine (Android only) runs the app on a connected Android device or emulator, captures HTTP/S traffic, monitors file system changes, and records logcat output during app execution.

As of 2026, MobSF has 21,200+ GitHub stars and an active release cycle — the latest stable version (check the MobSF GitHub releases page). It is maintained at mobsf.github.io/Mobile-Security-Framework-MobSF/.

Installing MobSF

Docker (recommended — no dependency conflicts):

docker pull opensecurity/mobile-security-framework-mobsf:latest
docker run -it --rm -p 8000:8000 \
  opensecurity/mobile-security-framework-mobsf:latest

Access the web UI at http://localhost:8000. The default API key is printed in the startup logs.

Direct install on Linux:

# Prerequisites: Python 3.10+, JDK 11+
git clone https://github.com/MobSF/Mobile-Security-Framework-MobSF.git
cd Mobile-Security-Framework-MobSF
./setup.sh
./run.sh 127.0.0.1:8000

Running your first static scan

Upload an APK via the web interface or the REST API:

# Upload via API
curl -F "[email protected]" \
  http://localhost:8000/api/v1/upload \
  -H "Authorization: <api_key>"

# The response includes a hash — use it to trigger analysis
curl "http://localhost:8000/api/v1/scan" \
  -X POST \
  -d "scan_type=apk&file_name=target.apk&hash=<hash>" \
  -H "Authorization: <api_key>"

# Download the JSON report
curl "http://localhost:8000/api/v1/report_json" \
  -X POST \
  -d "hash=<hash>" \
  -H "Authorization: <api_key>"

Reading the MobSF static analysis report

The report organizes findings into several sections. Focus on these when reviewing:

Security score: MobSF assigns a score out of 100. Scores below 40 typically indicate critical findings; above 70 means a relatively hardened app. Use this as a quick triage signal, not a final judgment.

Manifest analysis: Lists all exported components, dangerous permissions, and security flags. Pay close attention to: - android:exported="true" with no android:permission defined — exploitable component - android:debuggable="true" — direct app debugging access - android:allowBackup="true" — ADB backup of private app data allowed - android:usesCleartextTraffic="true" — HTTP allowed

Code analysis: Flags dangerous API calls and patterns: - Hardcoded credentials (password, secret, api_key in string literals) - Weak hash algorithms (MD5, SHA1 used for passwords) - Insecure random (java.util.Random instead of SecureRandom) - SQL injection risk (string concatenation in database queries) - World-readable/writable file operations

Binary analysis: Checks for code obfuscation, anti-tampering, and debug flags in the compiled binary.

MobSF dynamic analysis setup

For dynamic analysis, connect a rooted Android device or start a rooted emulator, then configure MobSF to use it:

# Start MobSF with dynamic analysis support
# (device must be connected via ADB)
adb devices  # confirm device is recognized

# In MobSF web UI: upload APK → click Dynamic Analyzer
# MobSF installs its agent on the device and begins instrumented testing

MobSF dynamic analysis captures: HTTP/S traffic (via its built-in proxy), file system changes during app execution, screenshots, and logcat output. Review the HTTP traffic log for cleartext credentials, sensitive data in URL parameters, and missing security headers.

Apktool — APK decoder and repackager

What Apktool does

Apktool decodes an APK file into its component parts: - smali/ — Dalvik bytecode in human-readable assembly format - res/ — decoded XML resources (layouts, strings, drawables) - AndroidManifest.xml — decoded manifest in readable XML - assets/ — raw asset files bundled in the APK

It can also rebuild a decoded APK back into a working APK, which is essential for: - Patching network_security_config.xml to trust user CA certificates (for Burp interception on Android 7+) - Patching out root or debuggability checks - Adding android:debuggable="true" to a release APK for dynamic analysis

Installing Apktool

# Kali Linux / Debian
sudo apt install apktool

# Manual install (any platform with Java)
# Download latest jar from https://apktool.org/
java -jar apktool.jar d target.apk -o decoded/

Core Apktool workflows

Decode an APK:

apktool d target.apk -o target_decoded/
# -o specifies output directory
# -r flag skips resource decoding (faster for manifest-only review)

Inspect the manifest:

cat target_decoded/AndroidManifest.xml

Look specifically for:

<!-- DANGEROUS: exported activity with no permission -->
<activity android:name=".AdminActivity" android:exported="true" />

<!-- DANGEROUS: debug enabled in release build -->
<application android:debuggable="true" ...>

<!-- RISK: backup allowed -->
<application android:allowBackup="true" ...>

Patch network security config for Burp interception (Android 7+):

# 1. Decode the APK
apktool d target.apk -o patched/

# 2. Find or create network_security_config.xml
# Location: patched/res/xml/network_security_config.xml
cat > patched/res/xml/network_security_config.xml << 'EOF'
<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
  <base-config>
    <trust-anchors>
      <certificates src="system" />
      <certificates src="user" />
    </trust-anchors>
  </base-config>
</network-security-config>
EOF

# 3. Update AndroidManifest.xml to reference the config
# Add: android:networkSecurityConfig="@xml/network_security_config"
# to the <application> element

# 4. Rebuild the APK
apktool b patched/ -o patched_signed.apk

# 5. Sign the rebuilt APK (required for installation)
keytool -genkey -v -keystore test.keystore \
  -alias testkey -keyalg RSA -keysize 2048 -validity 10000
jarsigner -verbose -sigalg SHA256withRSA \
  -digestalg SHA-256 -keystore test.keystore \
  patched_signed.apk testkey

# 6. Install the patched APK
adb install patched_signed.apk

This workflow allows you to intercept HTTPS traffic from apps that do not trust user-installed certificates — without needing root on the device.

Combining MobSF and Apktool in an assessment

The two tools are complementary, not redundant. Here is the recommended integration sequence:

1. MobSF static scan — get the automated baseline, identify the highest-severity flags, review the manifest summary and code findings
2. Apktool decode — manually read the full manifest, check for issues MobSF summarized but did not fully expose
3. jadx decompile — manually review the code areas flagged by MobSF (crypto implementations, WebView config, authentication logic)
4. Apktool repackage — if traffic interception requires patching the network security config, use Apktool to modify and rebuild

For the dynamic phase, the static vs dynamic analysis comparison explains which findings need runtime validation and how to structure the transition.

Frequently asked questions

What is MobSF used for in mobile security testing?

MobSF (Mobile Security Framework) is an open-source automated security testing platform for Android APKs, iOS IPAs, and Windows apps. It performs static analysis — decompiling the binary, reading the manifest, and scanning code for dangerous patterns — and dynamic analysis on Android, running the app on a connected device and capturing runtime behavior, traffic, and file system changes. It is typically the first tool run in a mobile security engagement.

What does Apktool do that MobSF doesn't?

Apktool decodes the APK into raw smali bytecode, editable XML resources, and the full manifest, and can rebuild a modified APK into a working, installable file. MobSF reads these artifacts but does not expose them for editing. Apktool is essential when you need to patch an APK — for example, modifying the network security config to trust user CA certificates for Burp interception.

Is MobSF free to use?

Yes. MobSF is fully open-source under the MIT license and available at mobsf.github.io. There is no paid version; it runs locally and does not send app data to any external server.

Do MobSF and Apktool work for iOS as well as Android?

MobSF supports iOS IPA static analysis — it inspects plist files, binary properties, and code signing. It does not support iOS dynamic analysis. Apktool is Android-only (APK/DEX format). For iOS analysis, the equivalents are ipatool for IPA extraction, class-dump or Hopper for binary analysis, and frida for dynamic instrumentation.

---

ThreatBlock's mobile app pentesting course covers Android and iOS security testing hands-on.

About the author: Samaksh is Lead Instructor at ThreatBlock and holds the OSCP, CRTP, CRTO, and CEH certifications, with hands-on experience in penetration testing and red teaming. Read more on the author page · Editorial policy.