Automated mobile scanning: MobSF, semgrep and triaging findings
You learn to scan APKs and IPAs with automated tools, read the report, weed out false alarms, write your own rules and connect scanning to the team's workflow.
Level 301 · 22 lessons · 18 practice labs
Lessons
Getting to know the scanner
- What automated scanning finds and what it misses
- A static scan with MobSF: upload and report sections
- Scripting scans with the MobSF REST API
- Scanning an IPA: plist, entitlement and binary findings
- Short task: scan an APK and pick the five most important findings in the report
Triaging findings
- Severity and context: the same finding differs per app
- Weeding out false alarms: confirming a finding in the code
- Mapping findings to MASVS items
- Merging duplicates and keeping a baseline
- Short task: sort a twenty-finding report into true, false alarm and informational
Writing rules
- semgrep rules for Kotlin and Java
- semgrep rules for Swift
- Secret scanning with apkleaks and patterns
- Security checks with Android lint
- Testing a rule: samples it must and must not catch
- Short task: write a semgrep rule that catches code logging a token
Connecting to the workflow
- Adding the scan to CI: thresholds and failed builds
- SARIF and report formats
- Comparing two versions: newly added permissions and SDKs
- Tracking a finding to closure: ticket, owner, rescan
- Short task: diff the scans of two versions and find the new risk
Capstone
- Capstone: set up scanning for a three-app portfolio and write the first report
Practice labs
- Scan an APK with MobSF and read the score: Upload an APK to the lab scanner and note the security score and finding counts.
- Script a scan with the REST API: Combine upload, scan and JSON report download in one script.
- Compare the reports of an IPA and an APK: Put the two platform scans of one app side by side and explain the findings that appear in only one.
- Pick the five most important findings in a report: Separate the high-severity findings and write a one-sentence reason for each.
- Weed out a false alarm by checking the code: Confirm three scanner-flagged findings in jadx output and close the invalid one with a reason.
- Triage a twenty-finding report and map it to MASVS: Sort findings into true, false alarm and informational, map the true ones to MASVS items and tabulate them.
- Run a ready-made semgrep rule: Run the rule that looks for insecure random number use in a Kotlin project and read the results.
- Write a rule that catches code logging a token: Write the rule and test it with samples it must and must not catch.
- Catch Swift code that skips certificate validation: Write a Swift rule that finds delegate code accepting trust evaluation unconditionally and verify it with three samples.
- Search an APK for secrets with apkleaks: Run the tool and list the patterns found.
- Add an organisation-specific key pattern: Add and test a custom pattern that catches Göktaşı Yazılım's internal service key format.
- Classify found secrets by validity and impact: Sort twelve matches into real secret, public identifier and false alarm and write rotation steps for the real ones.
- Export a scan result as SARIF: Produce semgrep output in SARIF format and examine its fields.
- Fail the build when a scan crosses the threshold: Write a gate script that exits non-zero when a high-severity finding exists and test it with two APKs.
- Report only new findings by keeping a baseline: Save the first scan as a baseline and write the script that lists only what is new in the next scan.
- Diff the permissions of two versions: Compare the permission lists of two APKs and find the newly added one.
- Find the newly added SDK and the risk it brings: Compare two scan reports and report the new library and the permissions that came with it.
- Set up scanning for a three-app portfolio: Write the script that scans Mavikaya Lojistik's three apps and gathers the results in one summary table, and deliver the first report.
About this course
You learn to scan APKs and IPAs with automated tools, read the report, weed out false alarms, write your own rules and connect scanning to the team's workflow.
What you will learn
- Getting to know the scanner
- Triaging findings
- Writing rules
- Connecting to the workflow
- Capstone
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.