Data

Tools

Indexes

Applications

Experiments

Awesome

An open API service indexing awesome lists of open source software.

awesome-apple-security

Curated list of tools, techniques and resources related to Apple Security (macOS, iOS, iPadOS, tvOS, watchOS) aimed to help people with an interest in Apple related security topics to get a hold in this field, and for professionals to discover / explore other resources.
https://github.com/BlackSquirrelz/awesome-apple-security

Last synced: 3 days ago
JSON representation

  • Apple Guidance

  • Articles

  • Attack Vectors and Adversary Techniques

  • Blogs

  • Books and Magazines

  • Conferences

  • Forensics

    • Acquisition and Evidence Collection

      • Cellebrite Digital Collector (Former Macquisition) - Commercial Tooling for Acquisition of macOS Forensic Images.
      • The ESF Playground - A tool to view the events in Apple Endpoint Security Framework (ESF) in real time.
      • mac_apt - Plugin based forensics framework for quick mac triage that works on live machines, disk images or individual artifact files.
      • Auditor - Deprecated macOS DFIR tool for older systems.
      • Collector - macOS offshoot for live response.

  • Hardware Information

  • Log Analysis

  • Malware

  • People

    • Acquisition and Evidence Collection

  • Persistence

  • Processes

    • Acquisition and Evidence Collection

  • Software Collections

  • Tools

    • Dynamic Analysis Tools

      • Corellium - The only platform offering ARM-based mobile device virtualization using a custom-built hypervisor for real-world accuracy and high performance.
      • itunnel - Use to forward SSH via USB.
      • membuddy - Dynamic memory analysis & visualisation tool for security researchers.
      • LLDB - A next generation, high-performance debugger.
      • Burp Suite - An advanced HTTPS proxy software.
      • Frida - Dynamic instrumentation toolkit for developers, reverse-engineers, and security researchers.
      • frida-gum - Cross-platform instrumentation and introspection library written in C.
      • Fridax - Fridax enables you to read variables and intercept/hook functions in Xamarin/Mono JIT and AOT compiled iOS/Android applications.
      • r2frida - Radare2 and Frida better together.
      • r2ghidra - An integration of the Ghidra decompiler for radare2.
      • iproxy - A utility allows binding local TCP ports so that a connection to one (or more) of the local ports will be forwarded to the specified port (or ports) on a usbmux device.
      • objection - A runtime mobile exploration toolkit, powered by Frida, built to help you assess the security posture of your mobile applications, without needing a jailbreak.
      • Grapefruit - Runtime Application Instruments for iOS.
      • Passionfruit - Simple iOS app blackbox assessment tool, powered by frida 12.x and vuejs.
      • Runtime Mobile Security (RMS) - Runtime Mobile Security (RMS), powered by FRIDA, is a powerful web interface that helps you to manipulate Android and iOS Apps at Runtime.
      • unidbg - Allows you to emulate an Android ARM32 and/or ARM64 native library, and an experimental iOS emulation.
      • Qiling - An advanced binary emulation framework.
      • fishhook - A library that enables dynamically rebinding symbols in Mach-O binaries running on iOS.
      • Dwarf - Full featured multi arch/os debugger built on top of PyQt5 and frida.
      • FridaHookSwiftAlamofire - A frida tool that capture GET/POST HTTP requests of iOS Swift library 'Alamofire' and disable SSL Pinning.
      • ios-deploy - Install and debug iOS apps from the command line. Designed to work on un-jailbroken devices.
      • aah - Run iOS arm64 binaries on x86_64 macOS, with varying degrees of success.
      • mitmproxy - A free and open source interactive HTTPS proxy.

    • File System

    • Frida

    • Offensive Tools

      • Mythic C2 - Mythic C2 Framework Documentation.
      • VOODOO - Browser Attack Framework for macOS.
      • SwiftSpy - macOS Keyloger written in Swift.

    • Process Viewer

    • Reverse Engineering Tools

      • Hopper - A reverse engineering tool that will assist you in your static analysis of executable files.
      • Sideloadly - An app to sideload your favorite games and apps to Jailbroken & Non-Jailbroken iOS devices.
      • AltStore - Allows to sideload other apps (.ipa files) onto iOS device.
      • Ghidra - A software reverse engineering (SRE) framework created and maintained by the National Security Agency Research Directorate.
      • Radare2 - UNIX-like reverse engineering framework and command-line toolset.
      • Cutter - Free and Open Source Reverse Engineering Platform powered by rizin.
      • frida-ios-dump - A tool to pull a decrypted IPA from a jailbroken device.
      • bagbak - Yet another frida based App decryptor. Requires jailbroken iOS device and frida.re.
      • flexdecrypt - An iOS App & Mach-O binary decryptor.
      • bfdecrypt - Utility to decrypt App Store apps on jailbroken iOS 11.x.
      • bfinject - Easy dylib injection for jailbroken 64-bit iOS 11.0 - 11.1.2. Compatible with Electra and LiberiOS jailbreaks.
      • r2flutch - Yet another tool to decrypt iOS apps using r2frida.
      • Clutch - A high-speed iOS decryption tool.
      • dsdump - An improved nm + objc/swift class-dump tool.
      • class-dump - A command-line utility for examining the Objective-C segment of Mach-O files.
      • iOS App Signer - An app for macOS that can (re)sign apps and bundle them into ipa files that are ready to be installed on an iOS device.
      • SwiftDump - A command-line tool for retriving the Swift Object info from Mach-O file.
      • jtool - An app inspector, disassembler, and signing utility for the macOS, iOS.
      • Cydia Impactor - A GUI tool for sideloading iOS application.

    • Static Analysis Tools

      • iFunbox - A general file management software for iPhone and other Apple products.
      • iTools - An All-in-One solution for iOS devices management.
      • iLEAPP - An iOS Logs, Events, And Plist Parser.
      • Keychain Dumper - A tool to check which keychain items are available to an attacker once an iOS device has been jailbroken.
      • BinaryCookieReader - A tool to read the binarycookie format of Cookies on iOS applications.
      • PList Viewer - Gtk application to view property list files.
      • XMachOViewer - A Mach-O viewer for Windows, Linux and macOS.
      • MachO-Explorer - A graphical Mach-O viewer for macOS. Powered by Mach-O Kit.
      • 3uTools - An All-in-One management software for iOS devices.

    • TCC & Permissions Tools

      • MacOS-Full-Disk-Access-Tunnel - Grant Full Disk Access to interpreter binaries (Python, Node, Ruby) so launchd and cron scripts can read TCC-protected data like Safari history, cookies, and Photos metadata.

  • Trainings

Programming Languages
Python 10 Objective-C 6 C 6 JavaScript 6 Swift 3 TypeScript 3 C++ 3 Java 2 Objective-C++ 2 Ruby 1
Categories
Tools 63 Books and Magazines 13 Blogs 6 Trainings 6 People 5 Forensics 5 Malware 4 Apple Guidance 3 Persistence 3 Software Collections 3 Attack Vectors and Adversary Techniques 2 Log Analysis 2 Conferences 2 Hardware Information 2 Articles 2 Processes 1
Sub Categories
Acquisition and Evidence Collection 51 Dynamic Analysis Tools 23 Reverse Engineering Tools 19 Frida 12 Static Analysis Tools 9 File System 3 Offensive Tools 3 TCC & Permissions Tools 1 Process Viewer 1
Keywords
reverse-engineering 9 ios 8 frida 8 android 4 radare2 3 instrumentation 3 unicorn-emulator 3 security 3 mobile-security 2 machoexplorer 2 macos 2 machoview 2 ios-security 2 malware 2 android-security 2 emulator 2 forensics 2 disassembler 2 c 2 macho 2 mobile 2 framework 2 ipa 2 debugger 2 emulation 1 dynarmic 1 capstone 1 fishhook 1 hypervisor 1 keystone 1 kvm 1 unicorn 1 unidbg 1 whale 1 xhook 1 analysis 1 binary 1 cross-architecture 1 decrypted 1 dumpdecrypted 1 pentest 1 binary-analysis 1 commandline 1 malware-analysis 1 iproxy 1 library 1 usb 1 usbmuxd 1 software-analysis 1 malware-detection 1