mobileAudit is a Django-based platform that runs SAST and malware checks on Android APK files for authorized security assessments and defensive application review.
| Tool | mpast/mobileAudit — Django web application for static application security testing and malware analysis of Android APKs |
| Tool | mpast/mobileAudit — Django application performing SAST and malware analysis for Android APKs |
| Primary Use | Uploading an APK in an authorized assessment or internal app-review pipeline, reviewing severity-ranked findings, and exporting PDF reports or pushing them to DefectDojo |
| Safe Use | Intended for authorized penetration tests, internal secure-SDLC reviews, and defensive malware research on samples you own or are licensed to analyze |
| Telemetry Note | Optional VirusTotal uploads and MalwareDB/Maltrail domain lookups generate outbound queries tied to your API key; analyzed artifacts and findings persist in local PostgreSQL, so scans leave evidence in the operator's own stack rather than on targets |
mobileAudit positions itself as a self-contained review workbench for Android packages: upload an APK, get metadata extraction, static analysis findings, and malware-indicator checks in one workspace. The repository (mpast/mobileAudit, ~229 stars, Python, GPL-3.0) is refreshingly explicit about its architecture, which immediately signals that this is a maintained engineering project rather than a script dump. The stack is a textbook production composition: Django 5.2 LTS for the web application and REST API, PostgreSQL 16 for persistence, Celery for background analysis jobs, RabbitMQ 4.2 as the task broker, and Nginx as the HTTP/TLS entry point. The runtime targets Python 3.12, with JADX handling the actual APK decompilation.
Deployment is deliberately boring in the best way: docker compose build followed by docker compose up brings up the entire stack, with the UI exposed at hxxp://localhost:8888. The README is appropriately cautious here — it explicitly instructs you to replace the example secret, database credentials, and administrator credentials in .env.example before running the application outside a local environment. That kind of warning matters for a tool whose whole purpose is ingesting untrusted binaries; an analyst spinning this up for the first time should heed it, since a weak admin credential on an internet-facing instance would turn your analysis platform into someone else's sample drop box.
The APK inspection surface is broad. Per scan, mobileAudit extracts application metadata, manifest components, requested permissions, signing certificates, embedded strings, bundled databases, and the file listing of the package. For an authorized mobile assessment this is the foundational reconnaissance layer: before you reason about vulnerabilities, you need to know what the app declares, what it ships, and what it talks to. Wiring this into a persistent workspace means you can diff finding counts across APK versions of the same application, which is exactly the workflow a secure-SDLC team needs when tracking whether a release regressed on security hygiene.
The SAST layer is rule-based and configurable. Findings map to CWE identifiers and the OWASP Mobile Top 10, which gives triage output a vocabulary that maps directly onto report templates and compliance frameworks. Analysis rules can be toggled from a Patterns screen, and the README credits apkleaks as the source of some hardcoded detection patterns — a sensible reuse of a well-known pattern corpus for secrets and risky strings in decompiled code. What you get on the findings side is severity summaries, detailed supporting evidence, an editing workflow, and explicit false-positive triage, which is the difference between a scanner and a review tool.
The malware-analysis capability is, properly, framed as indicator checking rather than detonation. Domain checks run against MalwareDB and Maltrail sources, and the VirusTotal integration supports API v3 lookups with optional uploads — disabled by default and configured through .env.example. That default-off posture is the right call for a defensive tool: uploading a potentially proprietary client APK to a third-party scanner is a disclosure decision the analyst should make deliberately, not have made for them. Combined with the SAST layer, this makes mobileAudit a reasonable first-pass triage station for suspicious Android samples in a lab context.
Where it fits in an authorized workflow is fairly clear. An internal app-security team or a consultant with a defined scope would create an application workspace, upload the client's APK, start a scan, and work through findings with evidence attached. From there, the reporting path is either PDF export or a DefectDojo API v2 finding export, which slots the tool neatly into an existing vulnerability-management pipeline rather than forcing yet another findings silo. The token-authenticated REST API (POST /api/v1/auth-token/, then Authorization: Token <api-key>) means the whole flow can be driven from CI, so scans can trigger automatically when a build produces an artifact.
The API surface is properly documented for its size: Swagger UI at /swagger/, ReDoc at /redoc/, and raw OpenAPI JSON/YAML at /swagger.json and /swagger.yaml. This is the kind of detail that separates tools designed for integration from tools designed for screenshots. The frontend, meanwhile, is Bootstrap 5 with native JavaScript — the README pointedly notes that navigation, live table filtering, sorting, pagination, confirmations, and scan status updates work without jQuery, which tells you the codebase has been through a modernization pass and that someone cares about the dependency surface.
Operationally, the Celery/RabbitMQ split means APK analysis happens out-of-band from the web request cycle — the right design when decompiling large packages with JADX, which can be slow and memory-hungry on obfuscated apps. Expect scan duration to vary meaningfully with sample size, and size your containers accordingly. For anything beyond localhost use, the README documents a TLS deployment path (docker-compose.prod.yaml with certificates in nginx/ssl) plus a one-day self-signed certificate generation example for local testing — again, defensive-minded defaults for a tool that may handle hostile binaries.
Topics on the repo (androguard, owasp, defect-dojo, virustotal, malware-analysis) align with what the README actually describes, which is a good sign of honest documentation; there is a Docker Hub image (mpast/mobile_audit) for those who prefer pulling to building, and a DeepWiki documentation mirror for deeper browsing. In summary, mobileAudit is a credible, architecturally sane option for teams that need repeatable, evidence-backed Android static analysis with an audit trail — not a magic detector, but a solid workbench for the authorized-review grind.
mpast/mobileAudit.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.