mobsf installation errors

[oxr463]

default: ERROR: Could not find a version that satisfies the requirement yara-python-dex>=1.0.0 (from apkid==2.1.2->-r requirements.txt (line 24)) (from versions: none)
default: ERROR: No matching distribution found for yara-python-dex>=1.0.0 (from apkid==2.1.2->-r requirements.txt (line 24))

    default: [INSTALL] Migrating Database
    default: Traceback (most recent call last):
    default:   File "manage.py", line 12, in <module>
    default:     from django.core.management import execute_from_command_line
    default: ModuleNotFoundError: No module named 'django'
    default: Traceback (most recent call last):
    default:   File "manage.py", line 12, in <module>
    default:     from django.core.management import execute_from_command_line
    default: ModuleNotFoundError: No module named 'django'
    default: Traceback (most recent call last):
    default:   File "manage.py", line 12, in <module>
    default:     from django.core.management import execute_from_command_line
    default: ModuleNotFoundError: No module named 'django'
    default: ./setup.sh: line 71: wkhtmltopdf: command not found

[outzhu]

What version is python3? Python3.10 breaks the setup.

Also might need to change apkid==2.1.2 to apkid==2.1.1 in requirements.txt

And add dependencies

• python3-venv
• python3-pip? (py3-pip?)
• build-essential
• libssl-dev
• libxslt1-dev
• libjpeg8-dev
• zlib1g-dev
• wkhtmltopdf

[oxr463]

What version is python3? Python3.10 MobSF/Mobile-Security-Framework-MobSF#1854 (comment) the setup.

For Vagrant, we're using Python 3.9 on Alpine 3.14

Reference(s):

• https://pkgs.alpinelinux.org/packages?name=python3&branch=v3.14
• https://github.com/infinite-omicron/pentesting-vm/blob/master/packer/source.vagrant.pkr.hcl#L3

[oxr463]

Also might need to change apkid==2.1.2 to apkid==2.1.1 in requirements.txt

That would need to be a PR upstream.

[outzhu]

I couldn't find the alternative packages for Alpine
Is there an alternative solution for mobsf?

[oxr463]

I couldn't find the alternative packages for Alpine

The names wouldn't be the same. Here is what I found.

Debian	Alpine
python3-venv	py3-virtualenv
python3-pip	py3-pip
build-essential	alpine-sdk
libssl-dev	openssl3-dev
libxslt1-dev	libxslt-dev
libjpeg8-dev	jpeg-dev
zlib1g-dev	zlib-dev
wkhtmltopdf	wkhtmltopdf*

*looks like this was dropped in https://gitlab.alpinelinux.org/alpine/aports/-/issues/12888

Is there an alternative solution for mobsf?

No, we need this tool for mobile app testing.

[outzhu]

I've hit a block due to the packages requirements.

==> pentesting-vagrant.vagrant.alpine: ./setup.sh: line 72: wkhtmltopdf: command not found

package required:

• wkhtmltopdf

==> pentesting-vagrant.vagrant.alpine: ERROR: unable to select packages:
    pentesting-vagrant.vagrant.alpine:   openssl3-dev (no such package):

unable to fetch packages:

• openssl3-dev

[oxr463]

We might be blocked on mobsf for now due to that dependency issue. Maybe for now we can comment it out to get our packer build to succeeded.

Reference(s):

• https://gitlab.alpinelinux.org/alpine/aports/-/merge_requests/23848

[outzhu]

Do you have any resources that I can study to repackage wkhtmltopdf for Alpine?

Reading through this https://wiki.alpinelinux.org/wiki/APKBUILD_Reference.

[oxr463]

Do you have any resources that I can study to repackage wkhtmltopdf for Alpine?

Reading through this https://wiki.alpinelinux.org/wiki/APKBUILD_Reference.

Alpine dropped the package due to security issues... We might be able to just build it from source as part of our Packer builds.

Also, looks like MobSF might replace that dependency per MobSF/Mobile-Security-Framework-MobSF#1982.

[oxr463]

See also: https://github.com/wkhtmltopdf/packaging

[outzhu]

See also: https://github.com/wkhtmltopdf/packaging

They don't seem to have Alpine.

• docker almalinux8-aarch64
• docker almalinux8-ppc64le
• docker almalinux8-x86_64
• docker almalinux9-aarch64
• docker almalinux9-ppc64le
• docker almalinux9-x86_64
• docker amazonlinux2-aarch64
• docker amazonlinux2-x86_64
• docker amazonlinux2022-aarch64
• docker amazonlinux2022-x86_64
• docker amazonlinux2_lambda
• docker archlinux-amd64
• docker bionic-amd64
• docker bionic-arm64
• docker bionic-armhf
• docker bionic-i386
• docker bionic-ppc64el
• docker bullseye-amd64
• docker bullseye-arm64
• docker bullseye-armel
• docker bullseye-armhf
• docker bullseye-i386
• docker bullseye-ppc64el
• docker buster-amd64
• docker buster-arm64
• docker buster-armel
• docker buster-armhf
• docker buster-i386
• docker buster-ppc64el
• docker centos7-aarch64
• docker centos7-i686
• docker centos7-ppc64le
• docker centos7-x86_64
• docker focal-amd64
• docker focal-arm64
• docker focal-armhf
• docker focal-ppc64el
• docker jammy-amd64
• docker jammy-arm64
• docker jammy-armhf
• docker jammy-ppc64el
• docker mxe-cross-win32
• docker mxe-cross-win64
• docker opensuse.leap15-aarch64
• docker opensuse.leap15-ppc64le
• docker opensuse.leap15-x86_64
• docker raspberrypi.bullseye-armhf
• docker raspberrypi.buster-armhf
• vagrant macos-cocoa
• vagrant msvc2015-win32
• vagrant msvc2015-win64