amrudesh1/morfMobile Reconnaissance Framework is a powerful, lightweight and platform-independent offensive mobile security tool designed to help hackers and developers identify and address sensitive information within mobile applications.
A powerful offensive security toolkit for mobile application analysis
Find Secrets. Protect Apps. Stay Secure.
MORF is an advanced mobile security analysis tool that automatically discovers sensitive information within Android and iOS applications. Designed for security professionals, penetration testers, and developers, MORF provides comprehensive insights into mobile app security posture.
MORF can be up and running in seconds using Docker or the included run script:
# Clone the repository and enter directory
git clone https://github.com/amrudesh1/morf && cd morf
# Option 1: Using the run script (recommended)
chmod +x run.sh && ./run.sh
# Option 2: Using Docker Compose
docker-compose up --build
Then simply visit http://localhost in your browser and upload an APK or IPA file to begin analysis!
MORF offers comprehensive security analysis capabilities for mobile applications:
| Feature | Description |
|---|---|
| 🔐 Secret & API Key Detection | Automatically discovers hardcoded credentials, API keys, and tokens throughout the application code and resources |
| 📱 Component Analysis | Extracts activities, services, receivers, and content providers, highlighting security risks in app structure |
| 🛡️ Permission Analysis | Identifies overprivileged applications and highlights dangerous permission combinations |
| 🔗 Deeplink Inspection | Maps URL schemes and deeplink patterns that could potentially be exploited |
| 📊 Metadata Collection | Gathers extensive app metadata for security assessment and threat modeling |
| 📜 Version Comparison | Tracks security changes between app versions to identify fixes and regressions |
MORF combines a Go backend with an Angular frontend for powerful analysis with an intuitive interface:
| Use Case | Description |
|---|---|
| 🕵️ Security Audits | Pre-release scanning to identify security issues before apps reach production |
| 🔍 Competitive Analysis | Understand security implementations in competitor applications |
| ⚙️ CI/CD Integration | Automate security checks in your build pipeline with MORF's CLI capabilities |
| 👨🏫 Security Education | Train developers on secure mobile development using real-world examples |
For macOS users, see README-LOCAL.md for detailed local development guide.
# Clone the repository
git clone https://github.com/amrudesh1/morf
cd MORF
# Start all services (MySQL, Redis, Backend, Frontend)
./run-local.sh start
# Or using docker-compose directly
docker-compose up -d
Services will be available at:
Common commands:
./run-local.sh start # Start all services
./run-local.sh stop # Stop all services
./run-local.sh status # Check service status
./run-local.sh logs # View logs
git clone https://github.com/amrudesh1/morf
cd morf
chmod +x run.sh
./run.sh
MORF requires the DATABASE_URL environment variable to connect to your database:
# macOS/Linux
export DATABASE_URL="root@tcp(localhost:3306)/Secrets?charset=utf8mb4&parseTime=True&loc=Local"
# Windows (CMD)
set DATABASE_URL=root@tcp(localhost:3306)/Secrets?charset=utf8mb4&parseTime=True&loc=Local
# Windows (PowerShell)
$env:DATABASE_URL = "root@tcp(localhost:3306)/Secrets?charset=utf8mb4&parseTime=True&loc=Local"
Note: Docker Compose will automatically use the environment variables set on your host machine.
After starting MORF, access the intuitive web interface at http://localhost and follow these steps:
MORF also provides a powerful CLI for automation and integration:
# Basic scan with console output
./morf cli --apk-path=/path/to/app.apk