Hashcat vs. Mobile Security Framework (MobSF)

Any time you want to perform offline password cracking exercises, Hashcat is going to be able to do that for you. I can't think of any scenario where you have a password hash you need to crack where another tool would be more suited to the task. Hashcat, of course, works best when you have a GPU available, but you can even use it on a VM if you use the --force flag.

Incentivized

MobSF is good for checking for vulnerabilities in your app. It will also give suggestions on how to address them. Another thing is can do is find code that may be incorrect. It is not, however, a substitute for a system that actually checks your code for proper use. It really is concentrated on security.

Incentivized

• GPU accelerated password cracking
• Rule based attacks
• Supports all the hash formats

Incentivized

• Scan for vulnerabilities
• Scan for bad coding
• Give suggestions on fixes for security issues

Incentivized

• When drivers for your GPU aren't working it can be very frustrating to get started
• Some 3rd party GUI exists for Hashcat, but having an official one could be nice

Incentivized

• The UI is not that user friendly
• The documentation could be easier to understand
• An easier method of deploying MobSF would be appreciated

Incentivized

In my opinion, MobSF is not as comprehensive as SonarQube. Both, however, do a very good job in scanning your code for vulnerabilities. Both do roughly the same things. The reports of SonarQube are more detailed though. The advantage that MobSF has over SonarQube is the price. One is free while the other is a paid solution (with several tiers). However, we use them together to get a more comprehensive scan.

Incentivized

• Hashcat is a free tool
• It can be used to test password policies
• Great tool for penetration testers doing offline password attacks

Incentivized

• It has allowed our apps to pass a security vetting requirement of a third party to deploy our app
• We can see where we can improve on the development of our app
• The deployment can take a while, especially with teams not familiar with the software

Incentivized