MobSF Mobile Security Framework on Ubuntu 24.04 on Azure User Guide

Overview

MobSF (Mobile Security Framework) is a widely used open source platform for automated mobile application security testing. It performs static analysis of Android APK, AAB and source and of iOS IPA and source, surfacing hardcoded secrets, insecure API usage, dangerous permissions, manifest and configuration weaknesses and known malware indicators, and presents the findings in a web dashboard with a REST API for automation. The cloudimg image runs MobSF 4.5.1 in a dedicated Python virtual environment served by gunicorn, bound to loopback and reverse proxied behind nginx on port 80.

Upstream MobSF serves an open, unauthenticated dashboard by default and seeds a published mobsf/mobsf administrator login. This image closes both: no administrator account is created, the whole dashboard and REST API are gated by HTTP Basic Authentication at the nginx reverse proxy, and the web password, REST API key and Django secret key are generated uniquely per instance at first boot, so nothing ships with a known credential.

This appliance provides static analysis, which runs entirely on the single virtual machine. MobSF's dynamic analysis feature additionally requires a connected Android device or emulator and is outside the scope of a single-node image.

What is included:

• MobSF 4.5.1 from the official release at /opt/mobsf, served by gunicorn on loopback 127.0.0.1:8000
• nginx reverse proxy on port 80 enforcing HTTP Basic Authentication, with an unauthenticated static /healthz for load balancer probes
• The Android and iOS static analysis toolchain: jadx (Java decompilation), apktool, baksmali, bundletool, apksigner and a JDK
• A per VM web password, REST API key and Django secret key generated at first boot, with no default administrator account
• mobsf-firstboot.service generating the secrets, writing the nginx credentials, rebuilding the database schema and starting the stack
• Host agnostic URLs: MobSF renders on the VM public IP, on 127.0.0.1, or on any domain you point at it
• MobSF and nginx enabled and auto starting on boot
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key, and a VNet with a subnet. Standard_B2s (2 vCPU, 4 GB RAM) is a comfortable starting point; move up to a D2s or D4s size for scanning large applications or running many scans in parallel. Open inbound ports 80 and 443 (and 22 to your management network) on the network security group. The gunicorn app listens only on loopback and is never exposed; nginx on port 80 is the single ingress.

Step 1: Deploy and connect

Launch the image from the Azure Marketplace, then connect over SSH as azureuser:

ssh azureuser@<vm-ip>

The first boot service generates the credentials, writes the nginx authentication file, rebuilds the database schema and starts MobSF within a few seconds of the instance starting.

Step 2: Verify the services

Confirm MobSF and nginx are active. MobSF is bound to loopback only on port 8000; nginx is the single ingress on port 80:

sudo systemctl is-active mobsf.service nginx.service
sudo ss -ltn | grep -E ':80|:8000'

Step 3: Check the versions

MobSF reports its version from its Django settings; the runtime is gunicorn on Python 3.12 with a JDK for the decompilation tooling:

sudo -u mobsf env HOME=/opt/mobsf MOBSF_SECRET_KEY=v MOBSF_API_KEY=v DJANGO_SETTINGS_MODULE=mobsf.MobSF.settings \
  /opt/mobsf/venv/bin/python -c 'import django;django.setup();from django.conf import settings;print("MobSF", settings.VERSION)'
/opt/mobsf/venv/bin/gunicorn --version
python3 --version
java -version 2>&1 | head -1

Step 4: The authenticated REST API

Every path except /healthz is protected by HTTP Basic Authentication at nginx. The REST API is additionally protected by a per VM API key sent in the X-Mobsf-Api-Key header. Read the credentials from the root only file, then list scans with the key, and confirm the same request is rejected without it:

WU=$(sudo sed -n 's/^MOBSF_WEB_USER=//p' /root/mobsf-credentials.txt)
WP=$(sudo sed -n 's/^MOBSF_WEB_PASSWORD=//p' /root/mobsf-credentials.txt)
KEY=$(sudo sed -n 's/^MOBSF_API_KEY=//p' /root/mobsf-credentials.txt)
curl -s -u "$WU:$WP" -H "X-Mobsf-Api-Key: $KEY" http://127.0.0.1/api/v1/scans | python3 -m json.tool | head -20
echo "--- without the api key (rejected) ---"
curl -s -u "$WU:$WP" http://127.0.0.1/api/v1/scans

Step 5: Read the credentials

The per VM credentials are written to a root only file. Read it to pick up the MOBSF_WEB_USER, MOBSF_WEB_PASSWORD and MOBSF_API_KEY:

sudo cat /root/mobsf-credentials.txt

Keep this file secure. The Django secret key lives in /etc/mobsf/mobsf.env (mode 0640 root:mobsf).

Step 6: Sign in to the dashboard

Confirm MobSF is serving locally, then browse to http://<vm-ip>/ in your browser. Your browser will prompt for the HTTP Basic Authentication credentials; sign in as mobsf with the password from Step 5. The dashboard opens on the Upload and Analyze view:

WP=$(sudo sed -n 's/^MOBSF_WEB_PASSWORD=//p' /root/mobsf-credentials.txt)
curl -s -o /dev/null -w 'unauth  : HTTP %{http_code}\n' http://127.0.0.1/
curl -s -o /dev/null -w 'signed in: HTTP %{http_code}\n' -u "mobsf:$WP" http://127.0.0.1/
curl -s -o /dev/null -w 'healthz : HTTP %{http_code}\n' http://127.0.0.1/healthz

Step 7: Scan an application

Upload an APK, AAB, IPA or source archive from the dashboard, or drive it through the REST API. The example below downloads a small test APK, uploads it and runs a static scan, printing the app name and security score. Use your own applications in place of the sample:

WU=$(sudo sed -n 's/^MOBSF_WEB_USER=//p' /root/mobsf-credentials.txt)
WP=$(sudo sed -n 's/^MOBSF_WEB_PASSWORD=//p' /root/mobsf-credentials.txt)
KEY=$(sudo sed -n 's/^MOBSF_API_KEY=//p' /root/mobsf-credentials.txt)
curl -fsSL -o /tmp/sample.apk https://github.com/OWASP/owasp-mastg/raw/master/Crackmes/Android/Level_01/UnCrackable-Level1.apk
HASH=$(curl -s -u "$WU:$WP" -H "X-Mobsf-Api-Key: $KEY" -F "file=@/tmp/sample.apk" http://127.0.0.1/api/v1/upload | python3 -c 'import json,sys;print(json.load(sys.stdin)["hash"])')
curl -s -u "$WU:$WP" -H "X-Mobsf-Api-Key: $KEY" -X POST --data "hash=$HASH&scan_type=apk&file_name=sample.apk" http://127.0.0.1/api/v1/scan \
  | python3 -c 'import json,sys;d=json.load(sys.stdin);print("app_name:",d.get("app_name"));print("security_score:",d.get("security_score"))'

Step 8: Review recent scans

The Recent Scans view lists every application you have analysed, with links to the static report and the AppSec scorecard for each. Sign in through your browser to reach it:

Step 9: The static analysis report

The static report is the heart of MobSF. It shows the application's scores, file and app information, a matrix of exported components, decompiled source and manifest views, the signer certificate, permissions, the results of the Android API and malware analysis, and every finding with its severity. This is the core output of the platform for each application you scan.

Step 10: The AppSec scorecard

The Application Security Scorecard summarises a scan at a glance: the security score, a risk rating and grade, the distribution of findings by severity, a privacy risk count, and the high, medium, informational and secure findings so you can prioritise remediation.

Step 11: Components

Step 12: Security and next steps

• Rotate the web password by regenerating the nginx basic-auth file: sudo htpasswd /etc/nginx/.mobsf_htpasswd mobsf then sudo systemctl reload nginx. Update /root/mobsf-credentials.txt to match.
• Enable HTTPS by installing certbot and requesting a certificate: sudo apt-get install -y certbot python3-certbot-nginx then sudo certbot --nginx.
• Restrict the network security group so that ports 80 and 443 are open only to your team or load balancer, and port 22 only to your management network.
• Automate scans with the REST API using the X-Mobsf-Api-Key header, wiring MobSF into your CI or release pipeline.
• Dynamic analysis is not enabled on this single-node appliance; it requires a connected Android device or emulator. Use the static analysis and REST API here, and run dynamic analysis separately if you need it.
• Point your domain at the instance; because MobSF allows any host, no rewrite is needed.
• Patch the OS regularly with sudo apt-get update and sudo apt-get upgrade.

Licensing

MobSF is distributed under the GPL-3.0 licence and is free to use commercially. cloudimg packages and supports the image; support is available 24/7 at support@cloudimg.co.uk. All product and company names are trademarks or registered trademarks of their respective holders and their use does not imply affiliation or endorsement.