Identify Mobile API vulnerabilities (XXE, SSRF, Path Traversal, IDOR).Free and open-source automated security assessment for both Android/iOS apps.

Fuzzing web APIs for security vulnerabilities (Web API Fuzzer: API rate limiting and session related vulnerabilities.).

Dynamic and static analysis (Dinamic SSL Testing, Dynamic analysis on custom VM/rooted android devices, Static analysis and stats).

Information Gathering & Security Headers Analyze.

So, if you are a developer, pentester or security analyst you can identify vulnerabilities in mobile apps at all stages of development. It also has specific Web API fuzzing capabilities powered by specific web api security scanner – CapFuzz. It support both binaries (APK, IPA & APPX ) and zipped source code. MobSF is an open source and intelligent tool which you can use to perform both static and dynamic analyses on Android/iOS/Windows platforms. MobSF: All-in-one Mobile (Android/iOS) Pentesting Framework

Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pentesting framework capable of performing static, dynamic and malware analysis, as well as web API testing.

Windows mac phone emulator appx