awesome-ios-security

A curated list of awesome iOS application security resources.
https://github.com/Cy-clon3/awesome-ios-security

Last synced: 1 day ago
JSON representation

Articles & Tutorials
Books
- SSL Pinning Bypass Tweaks
  - iOS Hacking Guide - By Security Innovation.
  - iOS Application Security: The Definitive Guide for Hackers and Developers - By David Thiel.
  - iOS Penetration Testing: A Definitive Guide to iOS Security - By Kunal Relan.
  - Learning iOS Penetration Testing - By Swaroop Yermalkar.
  - Hacking and Securing iOS Applications - By Jonathan Zdziarski.
  - iOS Hacker's Handbook - By Charlie Miller.
  - iOS Penetration Testing: A Definitive Guide to iOS Security - By Kunal Relan.
  - iOS Penetration Testing: A Definitive Guide to iOS Security - By Kunal Relan.
  - iOS Penetration Testing: A Definitive Guide to iOS Security - By Kunal Relan.
  - iOS Penetration Testing: A Definitive Guide to iOS Security - By Kunal Relan.
  - iOS Penetration Testing: A Definitive Guide to iOS Security - By Kunal Relan.
  - iOS Penetration Testing: A Definitive Guide to iOS Security - By Kunal Relan.
  - iOS Penetration Testing: A Definitive Guide to iOS Security - By Kunal Relan.
  - iOS Penetration Testing: A Definitive Guide to iOS Security - By Kunal Relan.
  - iOS Penetration Testing: A Definitive Guide to iOS Security - By Kunal Relan.
  - iOS Penetration Testing: A Definitive Guide to iOS Security - By Kunal Relan.
  - iOS Penetration Testing: A Definitive Guide to iOS Security - By Kunal Relan.
  - iOS Penetration Testing: A Definitive Guide to iOS Security - By Kunal Relan.
  - iOS Penetration Testing: A Definitive Guide to iOS Security - By Kunal Relan.
  - iOS Penetration Testing: A Definitive Guide to iOS Security - By Kunal Relan.
  - iOS Penetration Testing: A Definitive Guide to iOS Security - By Kunal Relan.
  - iOS Penetration Testing: A Definitive Guide to iOS Security - By Kunal Relan.
  - iOS Penetration Testing: A Definitive Guide to iOS Security - By Kunal Relan.
  - iOS Penetration Testing: A Definitive Guide to iOS Security - By Kunal Relan.
  - iOS Penetration Testing: A Definitive Guide to iOS Security - By Kunal Relan.
  - iOS Penetration Testing: A Definitive Guide to iOS Security - By Kunal Relan.
  - iOS Penetration Testing: A Definitive Guide to iOS Security - By Kunal Relan.
  - iOS Penetration Testing: A Definitive Guide to iOS Security - By Kunal Relan.
  - iOS Penetration Testing: A Definitive Guide to iOS Security - By Kunal Relan.
  - iOS Penetration Testing: A Definitive Guide to iOS Security - By Kunal Relan.
  - iOS Penetration Testing: A Definitive Guide to iOS Security - By Kunal Relan.
  - iOS Penetration Testing: A Definitive Guide to iOS Security - By Kunal Relan.
  - iOS Penetration Testing: A Definitive Guide to iOS Security - By Kunal Relan.
  - iOS Penetration Testing: A Definitive Guide to iOS Security - By Kunal Relan.
  - iOS Penetration Testing: A Definitive Guide to iOS Security - By Kunal Relan.
  - iOS Penetration Testing: A Definitive Guide to iOS Security - By Kunal Relan.
  - iOS Penetration Testing: A Definitive Guide to iOS Security - By Kunal Relan.
  - iOS Penetration Testing: A Definitive Guide to iOS Security - By Kunal Relan.
  - iOS Penetration Testing: A Definitive Guide to iOS Security - By Kunal Relan.
  - iOS Penetration Testing: A Definitive Guide to iOS Security - By Kunal Relan.
  - iOS Penetration Testing: A Definitive Guide to iOS Security - By Kunal Relan.
  - iOS Penetration Testing: A Definitive Guide to iOS Security - By Kunal Relan.
  - iOS Penetration Testing: A Definitive Guide to iOS Security - By Kunal Relan.
  - iOS Penetration Testing: A Definitive Guide to iOS Security - By Kunal Relan.
  - iOS Penetration Testing: A Definitive Guide to iOS Security - By Kunal Relan.
  - iOS Penetration Testing: A Definitive Guide to iOS Security - By Kunal Relan.
  - iOS Penetration Testing: A Definitive Guide to iOS Security - By Kunal Relan.
  - iOS Penetration Testing: A Definitive Guide to iOS Security - By Kunal Relan.
  - iOS Penetration Testing: A Definitive Guide to iOS Security - By Kunal Relan.
  - iOS Penetration Testing: A Definitive Guide to iOS Security - By Kunal Relan.
  - iOS Penetration Testing: A Definitive Guide to iOS Security - By Kunal Relan.
  - iOS Penetration Testing: A Definitive Guide to iOS Security - By Kunal Relan.
  - iOS Penetration Testing: A Definitive Guide to iOS Security - By Kunal Relan.
  - iOS Penetration Testing: A Definitive Guide to iOS Security - By Kunal Relan.
  - iOS Penetration Testing: A Definitive Guide to iOS Security - By Kunal Relan.
  - iOS Penetration Testing: A Definitive Guide to iOS Security - By Kunal Relan.
  - iOS Penetration Testing: A Definitive Guide to iOS Security - By Kunal Relan.
  - iOS Penetration Testing: A Definitive Guide to iOS Security - By Kunal Relan.
  - iOS Penetration Testing: A Definitive Guide to iOS Security - By Kunal Relan.
  - iOS Penetration Testing: A Definitive Guide to iOS Security - By Kunal Relan.
  - Learning iOS Penetration Testing - By Swaroop Yermalkar.
  - iOS Penetration Testing: A Definitive Guide to iOS Security - By Kunal Relan.
  - iOS Penetration Testing: A Definitive Guide to iOS Security - By Kunal Relan.
  - iOS Penetration Testing: A Definitive Guide to iOS Security - By Kunal Relan.
  - iOS Penetration Testing: A Definitive Guide to iOS Security - By Kunal Relan.
  - iOS Penetration Testing: A Definitive Guide to iOS Security - By Kunal Relan.
  - iOS Penetration Testing: A Definitive Guide to iOS Security - By Kunal Relan.
  - iOS Penetration Testing: A Definitive Guide to iOS Security - By Kunal Relan.
  - iOS Penetration Testing: A Definitive Guide to iOS Security - By Kunal Relan.
  - iOS Penetration Testing: A Definitive Guide to iOS Security - By Kunal Relan.
Checklists & Cheatsheets
- SSL Pinning Bypass Articles
Courses
- SSL Pinning Bypass Tweaks
  - Pentesting iOS Applications - By PentesterAcademy.
  - iOS Pentesting - By Mantis.
  - iOS Application Pentesting Series - By Sateesh Verma.
  - IOS: Penetration Testing - By Noisy Hacker.
  - iOS Pentesting - By Mantis.
  - iOS Application Pentesting Series - By Sateesh Verma.
  - IOS: Penetration Testing - By Noisy Hacker.
CTF
- SSL Pinning Bypass Articles
Frida Scripts
- SSL Pinning Bypass Tweaks
  - iOS 13 SSL Bypass - SSL Pinning Bypass for iOS 13.
  - iOS 12 SSL Bypass - SSL Pinning Bypass for iOS 12.
  - iOS Jailbreak Detection Bypass - A Frida script used for bypass iOS jailbreak detection by hooking some methods and functions.
  - iOS App Static Analysis - Script for iOS app's static analysis.
  - Touch ID Bypass - A Frida script for iOS Touch/Face ID Bypass.
  - FridaSwiftDump - A Frida script for retriving the Swift Object info from an running app.
Labs
- SSL Pinning Bypass Articles
Misc
- SSL Pinning Bypass Articles
  - iOS Jailbreak Downloads - Download Jailbreak Tools for All iOS Versions.
  - MOBEXLER - A customised virtual machine, designed to help in penetration testing of Android & iOS applications.
  - frida Workbench - Unofficial frida workbench for VSCode.
  - Apple Configurator - Apple Configurator features a flexible, device-centric design that enables you to configure one or dozens of devices quickly and easily.
  - Apple Platform Security - Explore Apple Platform Security.
  - IPSW Downloads - Download current and previous versions of Apple's iOS, iPadOS, macOS, watchOS, tvOS and audioOS firmware and receive notifications when new firmwares are released.
  - theos - A cross-platform suite of tools for building and deploying software for iOS and other platforms.
Sessions & Workshops
- SSL Pinning Bypass Tweaks
  - iOS + Frida Tutorial - A 3-parts workshop contains an introduction to Frida and iOS, low-level iOS interfaces (GCD, XPC, IOKit, Mach), and Objective-C instrumentation by @naehrdine.
  - Exploiting Common iOS Apps' Vulnerabilities - A session by @ivRodriguezCA that walks through some of the most common vulnerabilities on iOS apps and shows how to exploit them.
  - iOS Reverse Engineering With Frida - How to get started in iOS RE with any PC/Mac, an iPhone, and Frida by @x71n3.
  - iOS Application Vulnerabilities and how to find them - How to get started with hacking iOS apps, environment requirement, play ground etc. by @0ctac0der.
  - iOS + Frida Tutorial - A 3-parts workshop contains an introduction to Frida and iOS, low-level iOS interfaces (GCD, XPC, IOKit, Mach), and Objective-C instrumentation by @naehrdine.
  - Exploiting Common iOS Apps' Vulnerabilities - A session by @ivRodriguezCA that walks through some of the most common vulnerabilities on iOS apps and shows how to exploit them.
Tools
- Dynamic Analysis Tools
  - Corellium - The only platform offering ARM-based mobile device virtualization using a custom-built hypervisor for real-world accuracy and high performance.
  - itunnel - Use to forward SSH via USB.
  - membuddy - Dynamic memory analysis & visualisation tool for security researchers.
  - LLDB - A next generation, high-performance debugger.
  - Burp Suite - An advanced HTTPS proxy software.
  - Frida - Dynamic instrumentation toolkit for developers, reverse-engineers, and security researchers.
  - frida-gum - Cross-platform instrumentation and introspection library written in C.
  - Fridax - Fridax enables you to read variables and intercept/hook functions in Xamarin/Mono JIT and AOT compiled iOS/Android applications.
  - r2frida - Radare2 and Frida better together.
  - r2ghidra - An integration of the Ghidra decompiler for radare2.
  - iproxy - A utility allows binding local TCP ports so that a connection to one (or more) of the local ports will be forwarded to the specified port (or ports) on a usbmux device.
  - objection - A runtime mobile exploration toolkit, powered by Frida, built to help you assess the security posture of your mobile applications, without needing a jailbreak.
  - Grapefruit - Runtime Application Instruments for iOS.
  - Passionfruit - Simple iOS app blackbox assessment tool, powered by frida 12.x and vuejs.
  - Runtime Mobile Security (RMS) - Runtime Mobile Security (RMS), powered by FRIDA, is a powerful web interface that helps you to manipulate Android and iOS Apps at Runtime.
  - unidbg - Allows you to emulate an Android ARM32 and/or ARM64 native library, and an experimental iOS emulation.
  - Qiling - An advanced binary emulation framework.
  - fishhook - A library that enables dynamically rebinding symbols in Mach-O binaries running on iOS.
  - Dwarf - Full featured multi arch/os debugger built on top of PyQt5 and frida.
  - FridaHookSwiftAlamofire - A frida tool that capture GET/POST HTTP requests of iOS Swift library 'Alamofire' and disable SSL Pinning.
  - ios-deploy - Install and debug iOS apps from the command line. Designed to work on un-jailbroken devices.
  - aah - Run iOS arm64 binaries on x86_64 macOS, with varying degrees of success.
  - mitmproxy - A free and open source interactive HTTPS proxy.
- Reverse Engineering Tools
  - Hopper - A reverse engineering tool that will assist you in your static analysis of executable files.
  - jtool - An app inspector, disassembler, and signing utility for the macOS, iOS.
  - Sideloadly - An app to sideload your favorite games and apps to Jailbroken & Non-Jailbroken iOS devices.
  - Cydia Impactor - A GUI tool for sideloading iOS application.
  - AltStore - Allows to sideload other apps (.ipa files) onto iOS device.
  - Ghidra - A software reverse engineering (SRE) framework created and maintained by the National Security Agency Research Directorate.
  - Radare2 - UNIX-like reverse engineering framework and command-line toolset.
  - Cutter - Free and Open Source Reverse Engineering Platform powered by rizin.
  - frida-ios-dump - A tool to pull a decrypted IPA from a jailbroken device.
  - bagbak - Yet another frida based App decryptor. Requires jailbroken iOS device and frida.re.
  - flexdecrypt - An iOS App & Mach-O binary decryptor.

Programming Languages

Objective-C 8 C 7 Python 7 JavaScript 5 TypeScript 4 Swift 3 C++ 3 Objective-C++ 3 Java 2 Vue 1

Categories

Books 70 Tools 55 Articles & Tutorials 54 Tweaks 23 Courses 7 CTF 7 Misc 7 Frida Scripts 6 Sessions & Workshops 6 Checklists & Cheatsheets 5 Writeups 4 Labs 4

Sub Categories

SSL Pinning Bypass Tweaks 91 SSL Pinning Bypass Articles 70 Dynamic Analysis Tools 23 Reverse Engineering Tools 22 Reverse Engineering Tweaks 12 Static Analysis Tools 10 Jailbrek Detection Bypass Tweaks 9 Reverse Engineering Articles 4 Penetration Testing Articles 4 Jailbrek Detection Bypass Articles 3

Keywords

ios 13 reverse-engineering 11 frida 8 security 6 android 5 unicorn-emulator 3 instrumentation 3 mobile 3 radare2 3 debugger 2 windows 2 linux 2 mobile-security 2 ios-security 2 macho 2 android-security 2 disassembler 2 emulator 2 c 2 macos 2 machoview 2 framework 2 ipa 2 machoexplorer 2 penetration-testing 1 owasp 1 mstg 1 masvs 1 mastg 1 ios-app 1 penetration-tests 1 security-audit 1 security-standards 1 standard 1 verification 1 capstone 1 dynarmic 1 emulation 1 fishhook 1 hypervisor 1 keystone 1 kvm 1 decrypted 1 dumpdecrypted 1 pentest 1 binary-analysis 1 commandline 1 forensics 1 malware-analysis 1 iproxy 1