Static analysis
MAST combines several static engines over the unpacked artifact (and the source repo when available). Everything below runs offline.
Native SAST
Line-anchored source analysis across Kotlin, Java, Swift and Objective-C
(.kt .java .swift .m .mm); comment lines are skipped. Representative rules:
Android (Kotlin / Java)
| Issue | CWE | Severity |
|---|---|---|
Empty checkServerTrusted (TLS trust-all) | CWE-295 | Critical |
| Allow-all hostname verifier | CWE-295 | High |
addJavascriptInterface / WebView universal or file access | CWE-749 | High |
| ECB / DES / RC4 / Blowfish cipher | CWE-327 | High |
| MD5 / SHA-1 | CWE-328 | Medium |
java.util.Random for security | CWE-330 | Medium |
MODE_WORLD_READABLE / WRITEABLE | CWE-276 | High |
SQL injection via rawQuery / execSQL concatenation | CWE-89 | High |
Runtime.exec / ProcessBuilder | CWE-78 | Medium |
Secret written to Log.* | CWE-532 | Medium |
iOS (Swift / Obj-C)
| Issue | CWE | Severity |
|---|---|---|
TLS trust bypass (performDefaultHandling, SecTrustSetExceptions, ...) | CWE-295 | High |
Secret in UserDefaults | CWE-312 | High |
UIWebView (deprecated) | CWE-749 | Medium |
CC_MD5 / CC_SHA1 | CWE-328 | Medium |
Secret in NSLog / print | CWE-532 | Low |
Flutter / Dart
Findings from the Dart engine fold into the mobile view: dart-* rule findings plus
tree-sitter taint results (TAINT-<cwe>-DART). Two Flutter-specific checks are worth
calling out:
- Resilience (RASP) absence - a Flutter app with no root / jailbreak / tamper-detection
package (freeRASP, flutter_jailbreak_detection, safe_device and similar) is flagged
against MASVS-RESILIENCE (
dart-no-rasp, CWE-919). - Pub typosquat - a dependency one character away from a popular pub package is flagged
(
dart-typosquat, CWE-1357).
SCA - vulnerable libraries & dependencies
Three layers, all mapped to CWE-1104 (use of an unmaintained / vulnerable component):
- Native libraries - version strings embedded in bundled binaries (
.so, dylibs) are matched against known-vulnerable builds: OpenSSL (CVE-2016-2107, CVE-2021-3711, CVE-2022-3602), SQLite < 3.39 (CVE-2020-13871), libpng 1.0-1.5 (CVE-2019-7317). - Native dependency manifests -
build.gradle(.kts),Podfile.lock,Package.resolved,gradle.lockfile(Gradle / CocoaPods / Swift PM) are matched against known-bad versions of okhttp, gson, jackson-databind, Alamofire and AFNetworking. - Pub / Dart - Flutter dependency CVEs are handled by the shared SCA engine.
Manifest & config
- AndroidManifest.xml - compiled binary XML (AXML) is decoded (via
pyaxmlparser) and evaluated for the usual misconfigurations - exported components,debuggable, cleartext traffic - through the shared IaC engine. When AXML cannot be decoded, a best-effort string heuristic is used. - Info.plist - App Transport Security -
NSAllowsArbitraryLoads(high) andNSAllowsArbitraryLoadsInWebContent(medium), both CWE-319. - Firebase - Realtime Database hosts, project ids and storage buckets are extracted from the artifact; when a scan is authorised, a read-only open-rules probe checks whether the database is world-readable.
- Permissions - Android permissions from the decoded manifest and iOS permissions mapped
from
Info.plistusage-description keys are surfaced and feed the privacy analysis.
Secrets
Every text member is run through the platform's secrets engine, so API keys, tokens and credentials shipped inside the app are caught alongside the mobile- specific findings.