MobSFScan
Auditor Job Name: Mobsfscan Auditor image: registry.gitlab.com/whitespots-public/security-images/mobsfscan:0.3.6 AppSec Portal Importer Name: Mobsfscan
MobSFScan is a static analysis tool that can find insecure code patterns in your Android and iOS source code. Supports Java, Kotlin, Swift, and Objective C Code. mobsfscan uses MobSF static analysis rules and is powered by semgrep and libsast pattern matcher.
Note that the Importer for MobSFScan only supports the --sarif format.
Curl example
curl -X POST localhost/api/v1/scan/import/ -H "Authorization: Token a75bb26171cf391671e67b128bfc8ae1c779ff7b" -H "Content-Type: multipart/form-data" -F "file=@./mobsfscan.json" -F "product_name=Product1" -F "product_type=Application" -F "scanner_name=Mobsfscan" -F "branch=dev" -F "repository=git@gitlab.com:whitespots-public/appsec-portal.git"In this command, the following parameters are used:
-X POST: specifies the HTTP method to be used (in this case, POST)-H "Authorization: Token <authorization_token>": specifies the authorization token obtained from AppSec Portal.-H "Content-Type: multipart/form-data": specifies the content type of the request.-F "file=@<report_file_path>": specifies the path to the report file generated by the scanner.-F "product_name=<product_name>": specifies the name of the product being scanned.-F "product_type=<product_type>": specifies the type of the product being scanned.-F "scanner_name=<scanner_name>": specifies the name of the scanner used to generate the report (Mobsfscan)-F "branch=<branch_name>": (optional) specifies the name of the branch in the source code repository (if applicable) This parameter is particularly useful when you want to associate the scan results with a specific branch in your repository. If not provided, the scan will be associated with the default branch
Asset information, if an auditor is used
-F "repository=<repository SSH URL>": If your product is code in a repository enter the address of your repository in a specific format, for example: git@gitlab.com:whitespots-public/appsec-portal.git-F "docker_image=<registry address>": If your product is image enter the address of the registry where your product is located, for example: registry.gitlab.com/whitespots-public/appsec-portal/back/auto_validator:latest-F "domain=<domain>": If your product is web enter the domain name of your product, for example: whitespots.io-F "host=<host>": If your product is web enter the IP address of your product, for example: 0.0.0.0-F "cloud_account=<Cloud Account Name>": if your product is a cloud account enter the cloud account name, for example: autotest-cloud_account
Report example:
$ mobsfscan tests/assets/src/
- Pattern Match ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ 3
- Semantic Grep ββββββ 37
mobsfscan: v0.3.0 | Ajin Abraham | opensecurity.in
ββββββββββββββββ€βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β RULE ID β android_webview_ignore_ssl β
ββββββββββββββββΌβββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
β DESCRIPTION β Insecure WebView Implementation. WebView ignores SSL Certificate errors and accept any SSL Certificate. This application is vulnerable to MITM attacks β
ββββββββββββββββΌβββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
β TYPE β RegexAnd β
ββββββββββββββββΌβββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
β PATTERN β ['onReceivedSslError\\(WebView', '\\.proceed\\(\\);'] β
ββββββββββββββββΌβββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
β SEVERITY β ERROR β
ββββββββββββββββΌβββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
β INPUTCASE β exact β
ββββββββββββββββΌβββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
β CVSS β 7.4 β
ββββββββββββββββΌβββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
β CWE β CWE-295 Improper Certificate Validation β
ββββββββββββββββΌβββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
β OWASP-MOBILE β M3: Insecure Communication β
ββββββββββββββββΌβββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
β MASVS β MSTG-NETWORK-3 β
ββββββββββββββββΌβββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
β REF β https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05g-Testing-Network-Communication.md#webview-server-certificate-verification β
ββββββββββββββββΌβββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
β FILES β ββββββββββββββββββ€ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β
β β β File β ../test_files/android_src/app/src/main/java/opensecurity/webviewignoressl/MainActivity.java β β
β β ββββββββββββββββββΌββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€ β
β β β Match Position β 1480 - 1491 β β
β β ββββββββββββββββββΌββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€ β
β β β Line Number(s) β 50 β β
β β ββββββββββββββββββΌββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€ β
β β β Match String β .proceed(); β β
β β ββββββββββββββββββΌββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€ β
β β β File β ../test_files/android_src/app/src/main/java/opensecurity/webviewignoressl/MainActivity.java β β
β β ββββββββββββββββββΌββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€ β
β β β Match Position β 1331 - 1357 β β
β β ββββββββββββββββββΌββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€ β
β β β Line Number(s) β 46 β β
β β ββββββββββββββββββΌββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€ β
β β β Match String β onReceivedSslError(WebView β β
β β ββββββββββββββββββ§ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β
ββββββββββββββββ§βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββLast updated