This project integrates multiple mobile application security scanners (MobSF, APKHunt, APKTool-Semgrep) with the secureCodeBox framework to provide automated, scalable security analysis of mobile application files (APK/IPA) in Kubernetes environments.
This documentation is organized into comprehensive sections covering all aspects of the system:
Comprehensive requirements specification covering:
- Functional and non-functional requirements
- Environment setup requirements
- System dependencies and prerequisites
- Performance and security requirements
- Testing and maintenance requirements
System design and architecture details including:
- High-level system architecture
- Component interactions and data flow
- Security architecture and scalability design
- Deployment architecture and integration points
- Mermaid diagrams for visual understanding
Developer-focused technical details covering:
- Complete API reference for all components
- Algorithm implementations and code examples
- Data storage implementation (in-memory and MinIO)
- Security implementations and basic error handling
- Current limitations and improvement areas
User-friendly guides and instructions including:
- Quick start guide for immediate setup
- Detailed usage instructions for all features
- Comprehensive troubleshooting guide
- Best practices and advanced features
- FAQ and support resources
Quick reference for environment configuration:
- Prerequisites and system requirements
- Environment variables and configuration
- Platform-specific setup notes
Detailed setup and configuration guide for the web interface:
- GUI deployment instructions
- Configuration options and customization
- Troubleshooting common GUI issues
- Advanced features and API endpoints
Roadmap and enhancement suggestions:
- Performance optimization opportunities
- Scalability considerations
- Update according to progress
- Start with End-User Documentation for setup and usage
- Refer to Requirements Documentation for system understanding
- Use the troubleshooting section in End-User Documentation for issues
- Review Architectural Documentation for system design
- Study Technical Documentation for implementation details
- Check Requirements Documentation for specifications
- Follow Environment Setup Documentation for quick setup
- Review GUI Setup Documentation for interface customization
Project/
├── apkhunt/ # APKHunt scanner integration
├── mobsf/ # MobSF scanner integration
├── apktool-semgrep/ # APKTool-Semgrep scanner integration
├── gui/ # Web application interface
├── test-files/ # Sample APK/IPA files for testing
├── setup_linux_latest.sh # Linux setup script
├── setup_env_win.ps1 # Windows setup script
└── docs/ # This documentation
├── README.md # This file
├── requirements.md # Requirements documentation
├── architecture.md # Architectural documentation
├── technical.md # Technical documentation
├── end-user.md # End-user documentation
├── gui-setup.md # GUI setup documentation
├── environment-setup.md # Environment setup guide
└── further-improvements.md # Future improvements
- Multiple Scanner Support: MobSF, APKHunt, and APKTool-Semgrep
- Web-based GUI: Easy-to-use interface for file upload and scan management
- Real-time Monitoring: Live scan progress and status updates
- Automated Results: Webhook-based result delivery
- Kubernetes Native: Full Kubernetes integration with Helm charts
- Security Focused: Containerized, isolated scan execution
- Scalable Architecture: Horizontal scaling and resource management
- Docker Desktop (Windows/Mac) or Docker Engine (Linux)
- At least 4GB RAM available
- Stable internet connection
- APK or IPA files for testing
chmod +x setup_linux_latest.sh
./setup_linux_latest.sh- Open browser to
http://localhost:8088 - Upload an APK or IPA file
- Select a scanner and start scanning
- View results in real-time
- Basic file upload and validation
- MobSF scanner integration
- Web-based GUI with real-time status
- Kubernetes deployment with Helm
- MinIO file storage integration
- Webhook-based result delivery
- Basic error handling and logging
- Basic error handling only
- No automated testing framework
- Limited security controls
- No caching implementation
- Basic logging
See Further Improvements for detailed roadmap.
- secureCodeBox Community Forums
- GitHub Issues for bug reports
- Project Wiki for additional resources
- Check the troubleshooting section in End-User Documentation
- Review logs using
kubectl logscommands - Verify system status with
kubectl get pods -A - Refer to GUI Setup Documentation for interface issues
- Documentation Version: 1.0.0
- Last Updated: July 2025
- Compatible with: secureCodeBox v4.x
- Supported Platforms: Windows, Linux, macOS
- Implementation Status: Proof of Concept
- secureCodeBox Documentation. https://www.securecodebox.io/docs/getting-started/installation
- secureCodeBox GitHub Repository. https://github.com/secureCodeBox/secureCodeBox
- MobSF (Mobile Security Framework). https://mobsf.github.io/docs/
- MobSF GitHub Repository. https://github.com/MobSF/Mobile-Security-Framework-MobSF
- APKHunt Documentation. https://github.com/Cyber-Buddy/APKHunt
- APKTool Documentation. https://ibotpeaches.github.io/Apktool/
- Semgrep Documentation. https://semgrep.dev/docs/
- Kubernetes Documentation. https://kubernetes.io/docs/
- Helm Documentation. https://helm.sh/docs/
- Docker Documentation. https://docs.docker.com/
- Minikube Documentation. https://minikube.sigs.k8s.io/docs/
- FastAPI Documentation. https://fastapi.tiangolo.com/
- Bootstrap Documentation. https://getbootstrap.com/docs/
- Jinja2 Template Engine. https://jinja.palletsprojects.com/
- MinIO Integrations. https://www.min.io/product/integrations
- boto3 (AWS SDK for Python). https://boto3.amazonaws.com/v1/documentation/api/latest/index.html
- OWASP Mobile Security Testing Guide. https://owasp.org/www-project-mobile-security-testing-guide/
- OWASP Mobile Top 10. https://owasp.org/www-project-mobile-top-10/
- NIST Mobile Application Security. https://www.nist.gov/cyberframework
- CIS Docker Benchmark. https://www.cisecurity.org/benchmark/docker/
- CIS Kubernetes Benchmark. https://www.cisecurity.org/benchmark/kubernetes/
- secureCodeBox Community. https://github.com/secureCodeBox/secureCodeBox/discussions
- Kubernetes Community. https://kubernetes.io/community/
- Stack Overflow. https://stackoverflow.com/
- Technical Writing Best Practices (2024). https://developers.google.com/tech-writing
Note: All URLs and references were current as of the last documentation update. For the most recent information, please visit the official documentation sites directly.