https://github.com/OWASP/igoat

OWASP iGoat - A Learning Tool for iOS App Pentesting and Security by Swaroop Yermalkar
https://github.com/OWASP/igoat

Last synced: 28 days ago
JSON representation

OWASP iGoat - A Learning Tool for iOS App Pentesting and Security by Swaroop Yermalkar

• Host: GitHub
• URL: https://github.com/OWASP/igoat
• Owner: OWASP
• License: gpl-3.0
• Created: 2016-09-14T17:36:11.000Z (about 8 years ago)
• Default Branch: master
• Last Pushed: 2023-01-05T16:13:18.000Z (almost 2 years ago)
• Last Synced: 2024-10-26T07:39:22.108Z (about 2 months ago)
• Language: C
• Homepage: https://igoatapp.com/
• Size: 114 MB
• Stars: 418
• Watchers: 34
• Forks: 102
• Open Issues: 4
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

• Awesome-Pentest - igoat - A Learning Tool for iOS App Pentesting and Security by Swaroop Yermalkar. `Objective-C` (Mobile Security / Vulnerable Apps)
• awesome-hacking-lists - OWASP/igoat - OWASP iGoat - A Learning Tool for iOS App Pentesting and Security by Swaroop Yermalkar (C)

README

        
![GSOC 2019](https://img.shields.io/static/v1.svg?label=GSOC&message=Google%20Summer%20of%20Code%202019&color=blue&logo=%20data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABgAAAAYCAYAAADgdz34AAAAAXNSR0IArs4c6QAABLFJREFUSA2tVV1sVFUQ/s45d7ulpT+63VSkQC1IIsHyAugDAWLwQSEQI/EnaGL0QWOQ6AMo+uAzJooJJJiIiQ8qkWDURIxGIlLUqEQTKz9REEpbMFhKt7ss7e49P35zb9jaqKEkTnL33jNn5ps538ycBa5D7MH8etuTX38dLlM3jQ+2rXRf1Q/LI99T9VRTMYy/rF+hUflAIeTEPkANe2Tvz9w1fuha/pMChE/RbDNRd83JWnigwzTO2Gma5+ec6eCWgnEDcMXfhl35j43cH4yiqOYSxbZX3YviVcXEDjVWR4tMRvUEegUXQzfNRtT1PJBbw7WFjocTv5DJwZgoZy7t3+N/34YwdhbKZKA0MO6i5UQ6/K8BYBC8gNsYKr8a6rZdCJePwx97EmH0e+rTxFTUDNW8FHrOs9CLD8OdeBp+6BOoKAPBuAou70knSDaYucrfA73wXbhTW+EHdqX2ypCdlNHgigjDn8Pz0R1PwSx8B+7oBuDi/n9ATgoQW+vqp8+EWrCb4C/B9xPciMnfSuVjLhlMM1sm6/vfSNZmwZvwR5YilAZdmlH6S9YmxFjMVl2bEcon08wTcO4LqEhwMHNfhm65E+BJE2GB/SCpLP8K3bUFgpFupL+1AGNfTF8ZtbbtQNt9zOo17iaV5ltDz3iErzpyTO7bH6KOBZ/xYHoSBmXl4M++ymZYh6g1v0OwaJRIEiBwcOrMlX26cV4+eAU/+l2yqTJtiLr3Qd1EMDsONNzKzMvwpaPUbYC5fS9AG5FQZBMwJ8EQLMEUvbaH2tZ6lD4kbM7pmwl0CagOQzXOh1ncg1D9E66XWTNT1byELXmaNmW4Xx6m3RAi2ohtqNLPjsCZmTyzzwmmPdS+VhvYQmBp0gaRDmNBZSG829GUFtPAAFS33AEUf0i/RUfK6E7bqiRLkWYQQ/kOJYNKQasVhR7nMmt8QJ/xA3S6EUJNGDsD++MqHvsKqXiPgaZBNTDT4hGeO6JuT0KX/elu2vZB1eUTX8EQLEtMwU5qkF1V7rUe6/zlU6eV5hzcsDxJBH4M7tjjaQEbyT8n2JdPEKiOjbAd7vgTDDKWJt26jJPMq6V08rRgCaaco9ZF2VXoDcXCJlzYwwndzP5nnwtVnH8/9JkcGf7cbiAm16TED3Go5G4QG86E7qQPfePiyCbBEnCRWgBZhAxG/JnXSRHvms4XmJ0VbRIsuTL6XuFaCE5Bkz25o27ZklDkz2yHJwYNajJpksmtDvEQaXkUZtFHiZHr28ZALKJmLuQ+AZV+5KWlDGdj7laY2c/B/byOpxvioSIaSmKpTA5AnSY1vvANPB30greg82vg+ncgFA4nbZm4ZdugWpcT+BnWowW+l+CFr9PLzkonTsjkAKSbHTDuFfkf+ZZ3yzLoWRvrzLwXdVDSkqW0EU0T3yX48+97P7CzGqoXmTl9iB2IMQGfElpbh72YhvZsR6VCVZYPP0wFM9X0prdNU+ccpziIpN+E8/zD6TsbLpcec1mcE2Mxl5/BC5XBWQ+ArZWKVOyaUjlQ1x3p+GOtQqcY+6D6rM+wFau1bvkvkCkFEOfKgcbuyMTsTTLlMquv9rms/zepHmheIs/1AP4F9DYB6+AcwCcAAAAASUVORK5CYII=)

____

Select the OWASP iGoat Version: [![Swift 4](https://img.shields.io/badge/Swift-4-blue.svg)](https://github.com/OWASP/iGoat-Swift) [![Objective C](https://img.shields.io/badge/Objective-C-blue.svg)](https://github.com/OWASP/igoat)

iGoat (Objective C) was presented at:

[![AppSec USA 2017](https://img.shields.io/badge/AppSec%20USA-2017-red.svg)](https://appsecusa2017.sched.com/event/B2Xk/igoat-a-self-learning-tool-for-ios-app-pentesting-and-security)   [![c0c0n 2017](https://img.shields.io/badge/c0c0n-2017-red.svg)](http://is-ra.org/c0c0n/2017/agenda)   [![SEC-T 2017](https://img.shields.io/badge/SEC--T-2017-red.svg)](https://www.sec-t.org/archive/2017_events/schedule/)   [![BruCON 2017](https://img.shields.io/badge/BruCON-2017-red.svg)](https://2017.brucon.org/index.php/Practical_iOS_App_Exploitation_and_Defense_using_iGoat)   [![Bugcrowd Levelup 2017](https://img.shields.io/badge/BugcrowdLevelUp-2017-red.svg)](https://forum.bugcrowd.com/t/levelup-2017-discussion-swaroop-owasp-igoat/3052)

## OWASP iGoat - A Learning Tool for iOS App Pentesting and Security [![Twitter Follow](https://img.shields.io/twitter/follow/espadrine.svg?style=social&label=Follow)](https://twitter.com/OWASPiGoat/)

iGoat is a learning tool for iOS developers (iPhone, iPad, etc.) and mobile app pentesters. It was inspired by the WebGoat project, and has a similar conceptual flow to it.

As such, iGoat is a safe environment where iOS developers can learn about the major security pitfalls they face as well as how to avoid them. It is made up of a series of lessons that each teach a single (but vital) security lesson.

### The lessons are laid out in the following steps: ###

1. Brief introduction to the problem.

1. Verify the problem by exploiting it.

1. Brief description of available remediations to the problem.

1. Fix the problem by correcting and rebuilding the iGoat program.

Step 4 is optional, but highly recommended for all iOS developers. Assistance is available within iGoat if you don't know how to fix a specific problem.

### Documentation: [iGoat Guide](https://swaroopsy.gitbooks.io/owasp-igoat-setup/content/)

### Project Details ###

__Page__ - https://www.owasp.org/index.php/OWASP_iGoat_Tool_Project

__Project Lead__ - Swaroop Yermalkar ([@swaroopsy](https://twitter.com/swaroopsy?lang=en))

__Twitter__ - ([@OWASPiGoat](https://twitter.com/owaspigoat?lang=en))

__Lead Developer__ - Anthony Gonsalves

### Vulnerabities Covered (version 3.0): ###

* __Key Management__

  * Hardcoded Encryption Keys

  * Key Storage Server Side

  * Random Key Generation

  

* __URL Scheme Attack__

  

* __Social Engineering__

  

* __Reverse Engineering__

  * String Analysis

  

* __Data Protection (Rest)__

  * Local Data Storage (SQLite)

  * Plist Storage

  * Keychain Usage

  * NSUserDefaults Storage

  

* __Data Protection (Transit)__

  * Server Communication

  * Public Key Pinning

  

* __Authentication__

  * Remote Authentication

  

* __Side Channel Data Leaks__

  * Device Logs

  * Cut-and-Paste

  * Backgrounding

  * Keystroke Logging

  

* __Tampering__ 

  * Method Swizzling

  

* __Injection Flaws__

  * SQL Injection

  * Cross Site Scripting

  

* __Broken Cryptography__

### How to countribute? ###

* You can add new exercises

* Testing iGoat and checking if any issues

* Suggest us new attacks

* Writing blogs / article about iGoat

* Spreading iGoat :)

To contribute to iGoat project, please contact __Swaroop__ ( [email protected] or @swaroopsy )

### Project Contributors - ###

* Anthony Gonsalves

* Junard Lebajan (@junard)

* Ken van Wyk

* Arun @he_hacks 

* Jonathan Carter

* Heefan

* Tilak Kumar

* Bernhard Mueller

* Sagar Popat

* Chandrakant Nial 

* Valligayatri Rachakonda

* Suraj Kumar

* masbog

* Cheena Kathpal

* Matt Tesauro