MobSF for penetration testers

Display subtitles automatically

None
In the preferred language only when the video is using another
Always in the preferred language
Always in the original language of the video

Preferred language:

Qualities

UbiCast player x

Keyboard shortcuts

Key

Action

K or space

Play / Pause

Mute / Unmute

Select next subtitles

Select next audio track

Show slide in full page or toggle automatic source change

left arrow

Seek 5s backward

right arrow

Seek 5s forward

shift + left arrow or J

Seek 10s backward

shift + right arrow or L

Seek 10s forward

control + left arrow

Seek 60s backward

control + right arrow

Seek 60s forward

shift + down arrow

Decrease volume

shift + up arrow

Increase volume

shift + comma

Decrease playback rate

shift + dot or shift + semicolon

Increase playback rate

end

Seek to end

beginning

Seek to beginning

Loading Click here to add:

Information on this media

Number of views:

74 (this month: 2)

Creation date:

July 6, 2022

Speakers:

Antoine Cervoise

License:

CC BY-SA v4

Description

MobSF is a free and OpenSource security scanner for mobile application. First, this talk will introduce MobSF and its different features. Then, the talk will present how MobSF can be used during a penetration test or a red team. After presenting how to setup the tool for penetration testing, different use cases will be presented, regarding two different points of view: - a security review of a mobile application (or an SDK), in this case, the mobile application or the specific SDK is the target. - an assessment where the mobile application is not directly the target, in this case, the mobile application is used for recon (and more). - a quick use case of usage for every penetration tester who don't want to dig into complex android methods These use cases will also point MobSF limits and how to handle them by using the API and homemade scripts. For some cases, a comparison with other tools (such as apkleaks) will be done. At last, a quick review of how bug report and feature requests are handled by the MobSF team.

Antoine Cervoise

Antoine is a penetration tester at Synacktiv. He enjoys computer science, electronics and D.I.Y., beers (drinking and making) by night… and he’s fond of cigars!

Mickael Benassouli

Pentester at Synacktiv