Mobile applications often expose more than functionality — they expose permissions, trackers, behaviors, and attack surfaces. This investigation demonstrates how MobSF can be used to perform professional Android application security analysis.
This repository contains a complete security investigation of the Snaptube Android APK using the Mobile Security Framework (MobSF) running inside Docker on Windows.
The objective of this analysis was to:
- Perform static security assessment
- Review dangerous permissions
- Detect embedded trackers
- Analyze application components
- Inspect certificates and signing methods
- Review network/server communication patterns
- Understand overall mobile application risk posture
MobSF (Mobile Security Framework) is an open-source mobile application security testing framework designed for automated Android and iOS application analysis.
It helps security researchers, penetration testers, malware analysts, and developers perform:
- Static Analysis
- Dynamic Analysis
- Malware Analysis
- API Testing
- Runtime Monitoring
- Privacy Assessment
MobSF supports:
- APK / AAB (Android)
- IPA (iOS)
- APPX (Windows Mobile)
Static analysis is performed without executing the application.
MobSF extracts and analyzes:
- AndroidManifest.xml
- classes.dex
- permissions
- trackers
- signing certificates
- embedded URLs
- API keys
- exported components
- third-party SDKs
APK Upload
↓
APK Extraction
↓
Manifest & Code Parsing
↓
Permission Analysis
↓
Tracker Detection
↓
Security Rule Evaluation
↓
Report Generation
- Dangerous permissions
- Hardcoded secrets
- Insecure configurations
- Suspicious SDKs
- Excessive exported components
- Privacy risks
Dynamic analysis is performed while the application is running inside an emulator or monitored environment.
MobSF monitors:
- Runtime behavior
- API calls
- Network traffic
- File access
- SSL communication
- System interactions
Application Launch
↓
Runtime Instrumentation
↓
Network Monitoring
↓
Behavior Analysis
↓
Threat Observation
↓
Runtime Report
- Live network communication
- Runtime API behavior
- SSL pinning bypass attempts
- Sensitive data leakage
- Suspicious background activity
- Docker Desktop
- Windows 10/11
- WSL2 Enabled
- Minimum 4GB RAM
docker pull opensecurity/mobile-security-framework-mobsf:latestdocker run -it --rm -p 8000:8000 opensecurity/mobile-security-framework-mobsf:latestURL: http://localhost:8000
Username: mobsf
Password: mobsf
- Open MobSF dashboard
- Click “Upload & Analyze”
- Upload APK file
- Wait for scan completion
- Review generated report
| Property | Value |
|---|---|
| Application | Snaptube |
| Package Name | com.snaptube.premium |
| Analysis Type | Static + Dynamic |
| Framework Used | MobSF |
| Deployment | Docker |
| Investigator | CyberHepisha |
| Category | Observation |
|---|---|
| Security Score | 35 / 100 |
| Trackers Detected | 12 |
| Exported Activities | 22 |
| Exported Services | 8 |
| Exported Receivers | 16 |
| Exported Providers | 2 |
The analysis identified multiple areas that may impact user privacy and application security posture.
The application requested several high-risk permissions during analysis.
| Permission | Risk Description |
|---|---|
| ACCESS_FINE_LOCATION | Access to precise GPS location |
| ACCESS_COARSE_LOCATION | Access to approximate location |
| CAMERA | Camera access |
| RECORD_AUDIO | Microphone access |
| READ_CONTACTS | Contact data access |
| GET_TASKS | Access to running application information |
These permissions should always be evaluated against actual application functionality and necessity.
MobSF identified multiple embedded analytics and advertising trackers.
| Tracker | Category |
|---|---|
| AppLovin | Advertising / Analytics |
| Facebook Analytics | Analytics |
| Google AdMob | Advertising |
| Firebase Analytics | Analytics |
| Pangle | Advertisement |
| Sensors Analytics | Behavioral Analytics |
| Bugly | Crash Reporting |
Trackers may collect:
- Usage analytics
- Behavioral metrics
- Device identifiers
- Advertising data
The reconnaissance module identified communication endpoints associated with:
- United States
- Europe
- Asia-based infrastructure
This helps analysts understand:
- Traffic distribution
- CDN usage
- Third-party service communication
- External infrastructure exposure
| Finding | Observation |
|---|---|
| Signature Scheme | v1 detected |
| SHA Algorithm | SHA1 |
| Certificate Duration | Long validity period |
| Signing Information | Available |
Older signing schemes and deprecated hashing algorithms should be reviewed carefully during mobile application assessments.
The APK exposed multiple Android components.
| Component | Count |
|---|---|
| Activities | 146 |
| Services | 34 |
| Receivers | 35 |
| Providers | 11 |
Exported components increase the application attack surface and should be validated for secure implementation.
| Tool | Purpose |
|---|---|
| MobSF | Mobile Security Analysis |
| Docker Desktop | Container Runtime |
| Windows 11 | Host Operating System |
| GitHub | Project Hosting |
| Chrome Browser | Dashboard Access |
- MobSF Official Documentation
- OWASP Mobile Top 10
- Android Security Best Practices
- Docker Documentation
This project was created for:
- Educational purposes
- Security research
- Mobile application assessment learning
This repository does not promote unauthorized testing or malicious activity.