Base
Hardened build
minimal ports, security patches applied at build time
MobSF Mobile Security Framework on Ubuntu 24.04 LTS
Azure
Security
MobSF, the open source Mobile Security Framework: automated static analysis of Android and iOS applications with a web dashboard and REST API.
Overview
MobSF (Mobile Security Framework) is a widely used open source platform for automated mobile application security testing. It performs static analysis of Android APK, AAB and source and of iOS IPA and source, surfacing hardcoded secrets, insecure API usage, dangerous permissions, manifest and configuration weaknesses and known malware indicators, and presents the findings in a web dashboard with a REST API for automation.
This image runs MobSF on a complete, hardened stack, assembled and ready rather than left for you to wire together. It suits application security teams, penetration testers and mobile developers who want a self hosted mobile app scanner running in their own cloud account. This appliance provides static analysis; MobSF's dynamic analysis additionally needs a connected device or emulator and is out of scope for a single virtual machine.
Why the cloudimg image
The cloudimg image runs MobSF served by gunicorn behind an authenticated reverse proxy, with the web password, REST API key and Django secret key generated uniquely for your instance on first boot and stored in a root only file, so nothing ships with a known password. Upstream MobSF serves an open, unauthenticated dashboard by default and seeds a published mobsf/mobsf admin login; this image closes both, enforcing HTTP Basic Authentication at the edge across the whole dashboard and API and creating no default account. The deployment guide covers uploading an app, reading a report, driving the REST API, pointing your domain and enabling HTTPS. 24/7 support is included.
Common uses
- Automated static security analysis of Android and iOS application binaries
- A self hosted mobile app scanner run inside your own cloud account for privacy
- REST API driven mobile AppSec checks wired into a CI or release pipeline
See it running
Real screenshots taken while testing this image against its deployment guide.
More in Security
KeePass Password Manager
Security
KeePass is a free, open source password manager that stores all your passwords in a highly encrypted database. The datab...
CrowdSec
Security
This image runs CrowdSec, the free and open source collaborative behavioural security engine.
Ollama GPU-Accelerated LLM Server
Security
This image runs Ollama 0.30, the easiest way to run open large language models locally - pull and serve Llama, Mistral, ...
OWASP ZAP
Security
This image runs OWASP ZAP (the Zed Attack Proxy), the world's most widely used open source web-application security scan...
step-ca
Security
This image runs step-ca, the open source online certificate authority from Smallstep for secure, automated X.509 and ACM...
Trivy Security Scanner
Security
This image runs Trivy, the open source, Apache-2.0 licensed all-in-one security scanner from Aqua Security.