MobSF Reporting,
From APK or IPA to Finding
MobSF report import for mobile app pentests. Load the MobSF JSON report and code, manifest, network, and binary issues land in one triage queue with files attached.
Import Once. Report From One Place.
MobSF takes an APK or IPA apart in minutes and returns a long report: insecure code patterns, manifest flags, network security config, binary protections, hardcoded secrets, and trackers. Neuron imports the MobSF JSON report so each of those becomes a triage decision instead of a paragraph you copy.
Download the report JSON from MobSF, or pull it from the /api/v1/report_json endpoint, and import it. Code analysis issues arrive with the source files and line numbers MobSF flagged, plus the CWE, OWASP MASVS, and OWASP Mobile Top 10 mappings and the CVSS score where MobSF supplies them.
MobSF performs both static and dynamic analysis. Neuron imports the static analysis report for Android and iOS apps, and each app keeps its own scope in the engagement.
$ curl -s localhost:8000/api/v1/report_json \ -H "Authorization: $MOBSF_KEY" \ -d "hash=$HASH" -o acme-mobile.json $ neuron import acme-mobile.json✓ MobSF: 38 issues, 214 resources- 16:44 Finding Cleartext traffic allowed by the app
- 16:38 Import MobSF: 38 issues, com.acme.mobile
- 16:35 Command curl .../api/v1/report_json
- 15:10 Import MobSF: 41 issues, AcmeMobile.ipa
Why MobSF Reporting Takes So Long
A MobSF static scan of a real banking or retail app returns dozens of code findings, each spread across many files, plus manifest warnings, certificate notes, and a long permission list. The issues that belong in a mobile application penetration test are in there, next to a lot of third-party library code the client never wrote.
Turning that into a mobile app pentest report usually means reading the MobSF PDF, deciding which results apply to the client's own code, and retyping file paths and MASVS references into each finding.
Test the Android and iOS builds of the same app, then retest both after the fix, and that copying happens four times.
Everything MobSF Produces, On the Engagement
Import MobSF output from the browser or with neuron import, and it lands the moment the import finishes.
Code Analysis
Each MobSF code rule as a scan issue, with every source file it matched listed as an affected resource and the line number MobSF reported.
Manifest and Network Config
Manifest findings such as debuggable builds, allowBackup, and exported components, and network security config issues such as cleartext traffic, with the components and domains they apply to.
Binary and Certificate
Missing binary protections like NX, PIE, stack canaries, and RELRO per native library, and signing certificate problems, each as its own issue.
Secrets, Permissions, Trackers
Possible hardcoded secrets, dangerous Android permissions, and embedded tracker SDKs, each grouped into one issue with every item listed.
Risky Domains and Firebase
Domains MobSF flags as malicious or located in OFAC-sanctioned regions, and Firebase databases it found exposed.
Standards Mappings
OWASP MASVS, OWASP Mobile Top 10, and CWE references, plus CVSS scores and CVE identifiers where MobSF provides them, shown on the issue.
How to Import MobSF Results
- 01
Scan the app in MobSF
Upload the APK or IPA to MobSF and let the static analysis finish, through the web interface or the REST API.
- 02
Get the JSON report
Download the report JSON from the scan page, or call the report_json API with the scan hash and your MobSF API key. The PDF is for reading. The JSON is what imports.
$ curl localhost:8000/api/v1/report_json -H "Authorization: $MOBSF_KEY" -d "hash=$HASH" -o acme-mobile.json - 03
Import it into the engagement
Pair the CLI once with neuron pair, then run neuron import on the file. The MobSF report is recognised from its content. Or choose Import in the browser and pick MobSF under Mobile.
$ neuron import acme-mobile.json - 04
Triage by report section
Group the queue by Service to work through code, manifest, network, and binary issues separately, and mark third-party library files not affected before you promote.
Your Infrastructure. Your Data.
Neuron is self-hosted. Import MobSF results from the browser or the CLI and they land on your own server, inside your network. Scan data never passes through a third-party cloud.
From MobSFto the Final Report
Library code is the noise in every MobSF scan. Mark the files under third-party packages as not affected, confirm what is left in the client's own code, and promote it. Only the affected files carry over to the finding.
The MASVS and CWE references MobSF attached are already on the issue, and your Findings Library supplies the approved description and remediation for the mobile issues you report on every engagement, from cleartext traffic to backups left enabled.
Every MobSF report is scoped to the app it describes, by package name and file hash, so the Android and iOS builds, or two different apps, sit side by side in the same engagement without overwriting each other.
MobSF Integration FAQ
The questions teams ask most about MobSF and Neuron.
How do I import MobSF results into a mobile app pentest report?
Export the MobSF static analysis report as JSON and import it into the engagement, in the browser or with neuron import. Code, manifest, network, certificate, and binary issues become scan issues with their files and standards mappings, ready to promote into findings.
Which MobSF report format does Neuron accept?
The MobSF JSON report, from the JSON download on the scan page or the /api/v1/report_json API. Reports from both Android and iOS scans are supported. The MobSF PDF report cannot be imported.
Does the MobSF import include hardcoded secrets?
Yes. Strings MobSF flags as possible hardcoded secrets become one issue with each candidate listed, mapped to CWE-312, so a tester can confirm which are real keys before reporting them.
Can I import MobSF reports for several apps into one engagement?
Yes. Each MobSF report is scoped to its app by package name and file hash, so an Android and an iOS build, or two separate apps, keep their own issues.
Does Neuron import MobSF dynamic analysis?
Neuron imports the MobSF static analysis JSON report. For the dynamic side of a mobile test, send the app's API traffic from Burp Suite with the Neuron extension so it lands on the same engagement.
Where does the MobSF report end up?
On your own self-hosted Neuron server, inside the engagement. App internals, the secrets MobSF found, and source paths never pass through a third-party cloud.
More Neuron Integrations
Prowler Reporting and Cloud Scan Import
Cloud and MobileScoutSuite Report Import and Reporting
Cloud and MobileBloodHound Reporting and Attack Path Import
Active DirectoryPCAP Import: Hosts and Services From Captures
Network DiscoveryNessus Reporting and .nessus File Import
Vulnerability ScannersQualys Report Import for Pentest Reporting
Vulnerability ScannersOpenVAS Reporting and Greenbone Report Import
Vulnerability ScannersNexpose and InsightVM Report Import
Vulnerability ScannersReady to Transform Your Security Practice?
See how Neuron helps security teams replace fragmented tools with a single platform for offensive security, bringing structure, visibility, and consistency to every engagement.
Platform