{"id":13546151,"url":"https://github.com/msuiche/elegant-bouncer","last_synced_at":"2026-01-29T17:12:08.195Z","repository":{"id":64972808,"uuid":"569263975","full_name":"msuiche/elegant-bouncer","owner":"msuiche","description":"ELEGANTBOUNCER is a detection tool for file-based mobile exploits.","archived":false,"fork":false,"pushed_at":"2025-09-17T06:03:36.000Z","size":5195,"stargazers_count":154,"open_issues_count":0,"forks_count":8,"subscribers_count":3,"default_branch":"main","last_synced_at":"2025-10-11T11:56:37.620Z","etag":null,"topics":["forensics","mobile"],"latest_commit_sha":null,"homepage":"https://www.msuiche.com","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/msuiche.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null}},"created_at":"2022-11-22T12:51:13.000Z","updated_at":"2025-10-09T12:24:04.000Z","dependencies_parsed_at":"2024-01-16T17:48:12.115Z","dependency_job_id":"b9828ce3-c318-48f9-b48e-42c865427ec2","html_url":"https://github.com/msuiche/elegant-bouncer","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/msuiche/elegant-bouncer","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/msuiche%2Felegant-bouncer","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/msuiche%2Felegant-bouncer/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/msuiche%2Felegant-bouncer/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/msuiche%2Felegant-bouncer/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/msuiche","download_url":"https://codeload.github.com/msuiche/elegant-bouncer/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/msuiche%2Felegant-bouncer/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28881386,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-29T16:41:59.663Z","status":"ssl_error","status_checked_at":"2026-01-29T16:39:39.641Z","response_time":59,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.6:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["forensics","mobile"],"created_at":"2024-08-01T12:00:32.584Z","updated_at":"2026-01-29T17:12:08.183Z","avatar_url":"https://github.com/msuiche.png","language":"Rust","funding_links":[],"categories":["Threat Detection and Forensics"],"sub_categories":["Packing, Obfuscation, Encryption, Anti-analysis"],"readme":"![alt text](banner.png) \n\n# ELEGANTBOUNCER\nELEGANTBOUNCER is a detection tool for file-based mobile exploits.\n\nIt employs an innovative approach for advanced file-based threat identification, eliminating the need for in-the-wild samples and outperforming traditional methods based on regular expressions or IOCs. At present, it primarily targets the identification of mobile vulnerabilities such as FORCEDENTRY (CVE-2021-30860), BLASTPASS (CVE-2023-4863, CVE-2023-41064), and TRIANGULATION (CVE-2023-41990).\n\n## Support Table\n| Threat Name    | CVEs                            | Supported          |\n|----------------|---------------------------------|--------------------|\n| FORCEDENTRY    | CVE-2021-30860                  | :white_check_mark: |\n| BLASTPASS      | CVE-2023-4863, CVE-2023-41064   | :white_check_mark: |\n| TRIANGULATION  | CVE-2023-41990                  | :white_check_mark: |\n| CVE-2025-43300 | CVE-2025-43300                  | :white_check_mark: |\n\n![output of the detection tool](./documentation/elegantbouncer.png)\n\n### Learn more\n- [FORCEDENTRY](documentation/FORCEDENTRY.md)\n- [BLASTPASS](documentation/BLASTPASS.md)\n\n## Terminal User Interface\n\n![ELEGANTBOUNCER TUI - Real-time parallel scanning visualization](./documentation/elegant-bouncer-tui.png)\n\nThe TUI mode provides real-time visualization of parallel scanning operations, showing all active worker threads simultaneously. Enable it with the `--tui` flag when scanning directories.\n\n## Getting started\n```\nelegant-bouncer v0.2\nELEGANTBOUNCER Detection Tool\nDetection tool for file-based mobile exploits.\n\nA utility designed to detect the presence of known mobile APTs in commonly distributed files.\n\nUsage: elegant-bouncer [OPTIONS] \u003cInput path\u003e\n\nArguments:\n  \u003cInput path\u003e\n          Path to the input file or folder\n\nOptions:\n  -v, --verbose\n          Print extra output while parsing\n\n  -s, --scan\n          Assess a given file or folder, checking for known vulnerabilities\n\n  -c, --create-forcedentry\n          Create a FORCEDENTRY-like PDF\n\n  -r, --recursive\n          Recursively scan subfolders\n\n  -m, --messaging\n          Scan messaging app databases for attachments (iOS backup format)\n\n  --ios-extract\n          Extract/reconstruct iOS backup to readable folder structure\n\n  -o, --output \u003cOUTPUT\u003e\n          Output directory for iOS backup extraction\n\n  -f, --force\n          Force overwrite of output directory if not empty\n\n  -e, --extensions \u003cEXTENSIONS\u003e\n          File extensions to scan (comma-separated, e.g., \"pdf,webp,ttf\")\n          Default: pdf,gif,webp,jpg,jpeg,png,tif,tiff,dng,ttf,otf\n\n  -h, --help\n          Print help information (use `-h` for a summary)\n\n  -V, --version\n          Print version information\n```\n\n### Scanning Files and Folders\n\n#### Single File Scan\nUse `--scan` to assess a single file for known vulnerabilities:\n```bash\nelegantbouncer --scan suspicious_file.pdf\n```\n\n#### Folder Scan\nScan all supported files in a directory:\n```bash\nelegantbouncer --scan /path/to/folder\n```\n\n#### Recursive Folder Scan\nUse `-r` flag to recursively scan all subdirectories:\n```bash\nelegantbouncer --scan /path/to/folder -r\n```\n\n#### Custom File Extensions\nSpecify which file types to scan using the `-e` flag:\n```bash\n# Scan only PDF and DNG files\nelegantbouncer --scan /path/to/folder -e pdf,dng\n\n# Scan only image files recursively\nelegantbouncer --scan /path/to/folder -r -e jpg,jpeg,png,webp,gif\n```\n\n#### Default Extensions\nBy default, the tool scans files with these extensions:\n- **Documents**: pdf\n- **Images**: gif, webp, jpg, jpeg, png, tif, tiff, dng\n- **Fonts**: ttf, otf\n\n### Example Output\n\nWhen scanning a directory, the tool provides:\n- Real-time progress updates\n- Immediate threat detection notifications\n- Summary table with all vulnerability types\n- Detailed infected files table with:\n  - File path\n  - Threat name\n  - Associated CVE IDs\n\n```\n[+] Scanning directory: /path/to/documents\n[+] Recursive mode enabled\n[+] Extensions: pdf, gif, webp, jpg, jpeg, png, tif, tiff, dng, ttf, otf\n\n[1] Scanning: /path/to/documents/invoice.pdf\n[2] Scanning: /path/to/documents/photo.jpg\n[3] Scanning: /path/to/documents/malicious.webp\n  └─ THREAT found: BLASTPASS\n[4] Scanning: /path/to/documents/report.pdf\n  └─ THREAT found: FORCEDENTRY\n\n[+] Scanned 4 files\n\n[+] Summary Results:\n╭────────────────┬───────────────────────────────┬──────────────────────────────────────────────────────────────────────────┬──────────╮\n│ name           │ cve_ids                       │ description                                                              │ detected │\n├────────────────┼───────────────────────────────┼──────────────────────────────────────────────────────────────────────────┼──────────┤\n│ FORCEDENTRY    │ CVE-2021-30860                │ Malicious JBIG2 PDF shared over iMessage                                 │ Yes      │\n│ BLASTPASS      │ CVE-2023-4863, CVE-2023-41064 │ Malicious WebP presumably shared over iMessage and other mediums         │ Yes      │\n│ TRIANGULATION  │ CVE-2023-41990                │ Maliciously crafted TrueType font embedded in PDFs shared over iMessage  │ No       │\n│ CVE-2025-43300 │ CVE-2025-43300                │ Malicious DNG with JPEG Lossless compression exploiting RawCamera.bundle │ No       │\n╰────────────────┴───────────────────────────────┴──────────────────────────────────────────────────────────────────────────┴──────────╯\n\n[!] Infected Files Details:\n╭────────────────────────────────┬─────────────┬───────────────────────────────╮\n│ path                           │ threat_name │ cve_ids                       │\n├────────────────────────────────┼─────────────┼───────────────────────────────┤\n│ /path/to/documents/report.pdf  │ FORCEDENTRY │ CVE-2021-30860                │\n│ /path/to/documents/malicious.webp │ BLASTPASS   │ CVE-2023-4863, CVE-2023-41064 │\n╰────────────────────────────────┴─────────────┴───────────────────────────────╯\n```\n\n### iOS Backup Analysis\n\n#### Extract iOS Backup Structure\nReconstruct an iOS backup to its readable folder structure:\n```bash\n# Extract backup to default location (creates _reconstructed folder)\nelegantbouncer --ios-extract /path/to/ios/backup\n\n# Extract to specific output directory\nelegantbouncer --ios-extract /path/to/ios/backup -o /path/to/output\n\n# Force overwrite if output directory exists\nelegantbouncer --ios-extract /path/to/ios/backup -o /path/to/output --force\n```\n\n#### Scan Messaging App Attachments\nScan iOS backup for malicious attachments in messaging apps:\n```bash\n# Scan messaging databases (iMessage, WhatsApp, Viber, Signal, Telegram)\nelegantbouncer --scan --messaging /path/to/ios/backup\n\n# Combine with extraction for complete analysis\nelegantbouncer --ios-extract /path/to/ios/backup -o /tmp/extracted\nelegantbouncer --scan --messaging /tmp/extracted\n```\n\nThis feature detects threats in attachments from:\n- **iMessage** - SMS/MMS database attachments\n- **WhatsApp** - Media files from chats\n- **Viber** - Shared files and media\n- **Signal** - Attachments folder (database is encrypted)\n- **Telegram** - Cached media files\n\n### create-forcedentry\nUse `--create-forcedentry` to generate a PDF from the ground up designed to exploit CVE-2021-30860. Work in progress.\n\nNote: Pre-made samples can be found in the [`samples/`](tests/samples/) directory.\n\n## Recommendations\nUse [**Lockdown Mode**](https://support.apple.com/en-us/HT212650) to decrease your attack surface if you think you are a person of interest.\n\n## Acknowledgements\n- [Hamid K. (@Hamid-K)](https://github.com/Hamid-K) for the original implementation of messaging app scanning and iOS backup reconstruction\n- [Valentin Pashkov, Mikhail Vinogradov, Georgy Kucherin (@kucher1n), Leonid Bezvershenko (@bzvr_), and Boris Larin (@oct0xor) of Kaspersky](https://securelist.com/operation-triangulation-the-last-hardware-mystery/111669/)\n- [Apple Security Engineering and Architecture (SEAR)](https://bugs.chromium.org/p/chromium/issues/detail?id=1479274)\n- [Bill Marczack](https://twitter.com/@billmarczak)\n- [Jeff](https://twitter.com/jeffssh/status/1474605696020881409) for helping me understand FORCEDENTRY\n- [Valentina](https://twitter.com/chompie1337) for suggesting this target\n- [Ian Beer](https://twitter.com/i41nbeer) and [Samuel Groß](https://twitter.com/5aelo) of Google Project Zero for their amazing write-up on the sample shared by Citizen Lab with them.\n- [@mistymntncop](https://twitter.com/mistymntncop) for our exchanges and his work on [CVE-2023-4863](https://github.com/mistymntncop/CVE-2023-4863)\n- [Ben Hawkes](https://blog.isosceles.com/the-webp-0day/)\n\n## References\n- [Detecting CVE-2025-43300: A Deep Dive into Apple's DNG Processing Vulnerability](https://www.msuiche.com/posts/detecting-cve-2025-43300-a-deep-dive-into-apples-dng-processing-vulnerability/)\n- [Researching Triangulation: Detecting CVE-2023-41990 with single byte signatures.](https://www.msuiche.com/posts/researching-triangulation-detecting-cve-2023-41990-with-single-byte-signatures./)\n- [Researching FORCEDENTRY: Detecting the Exploit With No Samples](https://www.msuiche.com/posts/researching-forcedentry-detecting-the-exploit-with-no-samples/)\n- [Researching BLASTPASS: Detecting the exploit inside a WebP file - Part 1](https://www.msuiche.com/posts/researching-blastpass-detecting-the-exploit-inside-a-webp-file-part-1/)\n- [Researching BLASTPASS: Analysing the Apple \u0026 Google WebP POC file - Part 2](https://www.msuiche.com/posts/researching-blastpass-analysing-the-apple-google-webp-poc-file-part-2/)","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmsuiche%2Felegant-bouncer","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmsuiche%2Felegant-bouncer","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmsuiche%2Felegant-bouncer/lists"}