MORF

Mobile Reconnaissance Framework

A powerful offensive security toolkit for mobile application analysis

Find Secrets. Protect Apps. Stay Secure.

📋 Table of Contents

• 💡 Overview
• 🚀 Quick Start
• 🔍 Key Features
• 🏗️ Architecture
• 📋 Common Use Cases
• 📦 Installation
  • Prerequisites
  • Method 1: Docker (Recommended)
  • Method 2: Run Script
  • Environment Configuration
• 🖥️ Usage
  • Web Interface
  • Command Line Interface
• 🏆 Conference Recognition
• 🛣️ Development Roadmap
• 👨‍💻 Authors
• 📄 License
• 🙏 Acknowledgments

💡 Overview

MORF is an advanced mobile security analysis tool that automatically discovers sensitive information within Android and iOS applications. Designed for security professionals, penetration testers, and developers, MORF provides comprehensive insights into mobile app security posture.

🚀 Quick Start

MORF can be up and running in seconds using Docker or the included run script:

# Clone the repository and enter directory
git clone https://github.com/amrudesh1/morf && cd morf

# Option 1: Using the run script (recommended)
chmod +x run.sh && ./run.sh

# Option 2: Using Docker Compose
docker-compose up --build

Then simply visit http://localhost in your browser and upload an APK or IPA file to begin analysis!

🔍 Key Features

MORF offers comprehensive security analysis capabilities for mobile applications:

🏗️ Architecture

MORF combines a Go backend with an Angular frontend for powerful analysis with an intuitive interface:

📋 Common Use Cases

📦 Installation

Prerequisites

• Docker (recommended for simplest installation)
• Alternatively: Go and Node.js for development setup

Method 1: Docker (Recommended)

For macOS users, see README-LOCAL.md for detailed local development guide.

# Clone the repository
git clone https://github.com/amrudesh1/morf
cd MORF

# Start all services (MySQL, Redis, Backend, Frontend)
./run-local.sh start

# Or using docker-compose directly
docker-compose up -d

Services will be available at:

• Frontend: http://localhost
• Backend API: http://localhost:9092/api
• Health Check: http://localhost:9092/api/health

Common commands:

./run-local.sh start    # Start all services
./run-local.sh stop     # Stop all services
./run-local.sh status   # Check service status
./run-local.sh logs     # View logs

Method 2: Run Script

git clone https://github.com/amrudesh1/morf
cd morf
chmod +x run.sh
./run.sh

Environment Configuration

MORF requires the DATABASE_URL environment variable to connect to your database:

# macOS/Linux
export DATABASE_URL="root@tcp(localhost:3306)/Secrets?charset=utf8mb4&parseTime=True&loc=Local"

# Windows (CMD)
set DATABASE_URL=root@tcp(localhost:3306)/Secrets?charset=utf8mb4&parseTime=True&loc=Local

# Windows (PowerShell)
$env:DATABASE_URL = "root@tcp(localhost:3306)/Secrets?charset=utf8mb4&parseTime=True&loc=Local"

Note: Docker Compose will automatically use the environment variables set on your host machine.

🖥️ Usage

Web Interface

After starting MORF, access the intuitive web interface at http://localhost and follow these steps:

1. Upload your APK or IPA file using the drag-and-drop interface
2. Wait for MORF to process and analyze the application
3. Explore the detailed results, including:
   • Discovered secrets and API keys
   • Component security analysis
   • Permission assessment
   • Deeplink mapping
   • Comprehensive metadata

Command Line Interface

MORF also provides a powerful CLI for automation and integration:

# Basic scan with console output
./morf cli --apk-path=/path/to/app.apk

🏆 Conference Recognition

Conference Appearances

🛣️ Development Roadmap

👨‍💻 Authors

@amrudesh1

📄 License

MORF is released under the MIT License. See the LICENSE file for more details.

🙏 Acknowledgments

• Secrets Patterns Database - Pattern database used by MORF for secret detection
• Open Source Security Community - For inspiration, feedback and support
• All Contributors - Everyone who has contributed code, feedback, and ideas to the MORF project