MobSF

Launch the image from the Azure Marketplace, then connect over SSH as azureuser:

ssh azureuser@<vm-ip>

Within a few seconds of the instance starting, the first-boot service generates the credentials, writes the nginx authentication file, rebuilds the database schema and starts MobSF.

Confirm that MobSF and nginx are active. MobSF is bound to loopback only, on port 8000. nginx is the single ingress, on port 80:

sudo systemctl is-active mobsf.service nginx.service
sudo ss -ltn | grep -E ':80|:8000'

MobSF reports its version from its Django settings. The runtime is gunicorn on Python 3.12, with a JDK for the decompilation tooling. Check the versions:

sudo -u mobsf env HOME=/opt/mobsf MOBSF_SECRET_KEY=v MOBSF_API_KEY=v DJANGO_SETTINGS_MODULE=mobsf.MobSF.settings \
  /opt/mobsf/venv/bin/python -c 'import django;django.setup();from django.conf import settings;print("MobSF", settings.VERSION)' /opt/mobsf/venv/bin/gunicorn --version python3 --version java -version 2>&1 | head -1

nginx protects every path except /healthz with HTTP Basic Authentication. The REST API is additionally protected by a per-VM API key, sent in the X-Mobsf-Api-Key header. Read the credentials from the root-only file and list scans with the key. Then confirm that the same request is rejected without it:

WU=$(sudo sed -n 's/^MOBSF_WEB_USER=//p' /root/mobsf-credentials.txt)
WP=$(sudo sed -n 's/^MOBSF_WEB_PASSWORD=//p' /root/mobsf-credentials.txt)
KEY=$(sudo sed -n 's/^MOBSF_API_KEY=//p' /root/mobsf-credentials.txt)
curl -s -u "$WU:$WP" -H "X-Mobsf-Api-Key: $KEY" http://127.0.0.1/api/v1/scans | python3 -m json.tool | head -20 echo "--- without the api key (rejected) ---"
curl -s -u "$WU:$WP" http://127.0.0.1/api/v1/scans

The per-VM credentials are written to a root-only file. Read it to get MOBSF_WEB_USER, MOBSF_WEB_PASSWORD and MOBSF_API_KEY:

sudo cat /root/mobsf-credentials.txt

Keep this file secure. The Django secret key is stored in /etc/mobsf/mobsf.env (mode 0640 root:mobsf).

Confirm that MobSF is serving locally, then browse to http://<vm-ip>/. Your browser prompts for the HTTP Basic Authentication credentials. Sign in as mobsf with the password from Step 5. The dashboard opens on the Upload and Analyze view.

Run these commands to check the three access paths:

WP=$(sudo sed -n 's/^MOBSF_WEB_PASSWORD=//p' /root/mobsf-credentials.txt)
curl -s -o /dev/null -w 'unauth : HTTP %{http_code}\n' http://127.0.0.1/
curl -s -o /dev/null -w 'signed in: HTTP %{http_code}\n' -u "mobsf:$WP" http://127.0.0.1/
curl -s -o /dev/null -w 'healthz : HTTP %{http_code}\n' http://127.0.0.1/healthz

Upload an APK, AAB, IPA or source archive from the dashboard, or drive the upload through the REST API. The following example downloads a small sample APK, uploads it and runs a static scan, then prints the app name and security score. Substitute your own applications for the sample:

WU=$(sudo sed -n 's/^MOBSF_WEB_USER=//p' /root/mobsf-credentials.txt)
WP=$(sudo sed -n 's/^MOBSF_WEB_PASSWORD=//p' /root/mobsf-credentials.txt)
KEY=$(sudo sed -n 's/^MOBSF_API_KEY=//p' /root/mobsf-credentials.txt)
curl -fsSL -o /tmp/sample.apk https://github.com/OWASP/owasp-mastg/raw/master/Crackmes/Android/Level_01/UnCrackable-Level1.apk
HASH=$(curl -s -u "$WU:$WP" -H "X-Mobsf-Api-Key: $KEY" -F "file=@/tmp/sample.apk" http://127.0.0.1/api/v1/upload | python3 -c 'import json,sys;print(json.load(sys.stdin)["hash"])')
curl -s -u "$WU:$WP" -H "X-Mobsf-Api-Key: $KEY" -X POST --data "hash=$HASH&scan_type=apk&file_name=sample.apk" http://127.0.0.1/api/v1/scan \
  | python3 -c 'import json,sys;d=json.load(sys.stdin);print("app_name:",d.get("app_name"));print("security_score:",d.get("security_score"))'

Sign in through your browser and open the Recent Scans view. It lists every application you have analyzed, with links to the static report and the AppSec scorecard for each.

The static report is the core output of MobSF for each application you scan. It shows the application's scores, file and app information, a matrix of exported components, decompiled source and manifest views, the signer certificate and permissions. It also shows the results of the Android API and malware analysis, and every finding with its severity.

The Application Security Scorecard summarizes a scan at a glance. It shows the security score, a risk rating and grade, the distribution of findings by severity, and a privacy risk count. It also lists the high, medium, informational and secure findings so you can prioritize remediation.

Use this table to locate the main files and services.

Component Path

MobSF install /opt/mobsf/

Python venv /opt/mobsf/venv/

jadx decompiler /opt/mobsf/jadx/bin/jadx

MobSF data (SQLite db, scans) /opt/mobsf/.MobSF/

Environment (secret key, API key) /etc/mobsf/mobsf.env (mode 0640 root:mobsf)

nginx basic-auth file /etc/nginx/.mobsf_htpasswd

gunicorn unit /etc/systemd/system/mobsf.service

nginx vhost /etc/nginx/sites-available/sac-mobsf

First-boot script /usr/local/sbin/mobsf-firstboot.sh

Credentials /root/mobsf-credentials.txt (mode 0600 root:root)

• Rotate the web password by regenerating the nginx basic-auth file: run sudo htpasswd /etc/nginx/.mobsf_htpasswd mobsf, then sudo systemctl reload nginx. Update /root/mobsf-credentials.txt to match.
• Enable HTTPS by installing certbot and requesting a certificate: run sudo apt-get install -y certbot python3-certbot-nginx, then sudo certbot --nginx.
• Restrict the network security group so that ports 80 and 443 are open only to your team or load balancer, and port 22 only to your management network.
• Automate scans with the REST API and the X-Mobsf-Api-Key header, and wire MobSF into your CI or release pipeline.
• Dynamic analysis is not enabled on this single-node appliance, because it requires a connected Android device or emulator. Use static analysis and the REST API here, and run dynamic analysis separately if you need it.
• Point your domain at the instance. Because MobSF allows any host, no rewrite is needed.
• Patch the OS regularly with sudo apt-get update and sudo apt-get upgrade.