Mobile Security,
Entirely in Your Browser
mSAS v2 is a comprehensive, browser-based mobile security analysis suite. It analyzes Android APKs, iOS IPA files, and audits live Android devices — all 100% client-side with zero data uploads.
What Is mSAS?
A unified platform for mobile application security testing, combining static analysis for both major mobile platforms with live device auditing.
Deep Static Analysis
Parses real DEX bytecode, Mach-O binaries, AndroidManifest.xml, Info.plist, certificates, provisioning profiles, and more. Over 230 security rules mapped to OWASP MASVS, CWE, and MSTG references.
100% Private & Secure
Every analysis runs inside a Web Worker in your browser. No files are ever uploaded to any server. You can disconnect from the internet after the page loads — the analysis works entirely offline.
Cross-Platform Coverage
Analyze Android APKs (DEX, AXML, certificates) and iOS IPAs (Mach-O, plist, entitlements, ATS) side by side. One suite, both platforms.
Rich Reporting
Export findings in SARIF 2.1, JSON, CSV, or PDF. Interactive dashboards with CVSS 3.1 scoring, risk matrices, severity trends, and evidence attachments.
The Three Tools
mSAS combines three powerful security analysis tools into a single unified interface.
APK Auditor
Deep static analysis for Android applications. Inspects DEX bytecode, AndroidManifest.xml, signing certificates, resources, and native libraries. Detects cryptography flaws, insecure storage, code execution risks, hardcoded secrets, and 150+ other vulnerability patterns.
IPA Auditor
Deep static analysis for iOS applications. Parses Mach-O binaries, Info.plist, provisioning profiles, entitlements, and App Transport Security (ATS) configuration. Detects 80+ security issues across privacy, data storage, and network security domains.
ADB Auditor
Browser-based Android device security auditing over WebUSB. Connect live devices, browse filesystems (with root support), run shell commands, analyze app storage and permissions, capture screenshots, and run OWASP-aligned security scans in real time.
How It Works
From uploading a file to getting a full security report — all within your browser.
Upload or Connect
Drag and drop an APK or IPA file, or connect an Android device via WebUSB. No server upload — files are processed entirely in your browser.
Extract & Parse
JSZip extracts the archive contents. Platform-specific parsers decode binary formats — DEX bytecode for Android, Mach-O for iOS, plus XML, plist, and certificate formats.
Scan with 230+ Rules
All security rules run against extracted strings, metadata, and binary data. Each finding is mapped to OWASP MASVS, CWE, and severity levels. Everything runs in a background Web Worker.
Score & Report
Findings are weighted by severity and computed into a security score (0–1000) with a letter grade (A+ through F). Explore results across categorized tabs and export as SARIF, JSON, CSV, or PDF.
Key Features
What makes mSAS different from other mobile security tools.
Zero Upload Privacy
All processing happens client-side via Web Workers. Your files never leave your machine.
Works Offline
PWA-enabled with service worker caching. After the first load, analyses work without internet.
230+ OWASP Rules
Mapped to OWASP MASVS L1+L2, CWE, and MSTG. Covers crypto, storage, network, code, and AI/ML.
CVSS 3.1 Scoring
Full CVSS 3.1 base/temporal/environmental scoring with vector parsing and risk heatmaps.
Multiple Export Formats
SARIF 2.1 for CI/CD pipelines, JSON, CSV, and styled PDF reports with executive summaries.
PWA Installable
Install as a standalone app on desktop and mobile. Full offline support with service worker.
Entropy Secrets Scanner
Shannon entropy analysis finds hardcoded API keys, tokens, and passwords in binary strings.
Batch Analysis
Queue multiple files for sequential analysis with aggregate stats, comparison tables, and combined reports.
Custom Rule Editor
Enable/disable rules, adjust priorities, create custom rules, and save profiles for different projects.
Privacy & Security
Your data stays where it belongs — on your machine.
No Server, No Uploads, No Telemetry
Every analysis runs entirely within a Web Worker in your browser tab. The files you analyze are never transmitted over the network. You can disconnect from the internet once the page has loaded and still run a complete analysis.
Architecture
Built with vanilla JavaScript — no frameworks, no build steps, maximum transparency.
Modular Scanner Design
Each security scanner is an independent IIFE module registered on the MSAS global namespace. Scanners are loaded dynamically by auditor pages and orchestrated by Web Workers for non-blocking analysis.
Web Worker Processing
All analysis runs in a background Web Worker to keep the UI responsive. The worker loads scanner modules, executes them against extracted data, and posts results back to the main thread.
No External Dependencies
Core analysis engines are written from scratch — DEX parser, Mach-O parser, binary plist decoder, AXML decoder, entropy calculator. Only JSZip (ZIP extraction) and jsPDF (PDF export) are external.
OWASP MASVS-Aligned
All 230+ rules are mapped to the OWASP Mobile Application Security Verification Standard (MASVS), Common Weakness Enumeration (CWE), and Mobile Security Testing Guide (MSTG) references.