awesome-apple-security

Commercial Tooling for Acquisition of macOS Forensic Images

mac_apt

Plugin based forensics framework for quick mac triage that works on live machines, disk images or individual artifact files

Auditor

Deprecated macOS DFIR tool for older systems

Collector

macOS offshoot for live response

A tool to view the events in Apple Endpoint Security Framework (ESF) in real time

Developer Documentation for reference

Security Documentation of Apple Products

In case you want to submit a vulnerability to Apple

Apple's Bug Bounty Program information

Apple Information on Platform Security

Documentation on the filesystem

Tools, Techniques and Attack Vectors used by adversaries to target macOS devices

How to evade the sandbox with MS Office Macros

Generic Blog on macOS Security

Wojciech's macOS Related blog

Cedric Owens Blog on macOS Security

Patrick Wardle's Website

Mac Forensics

Mandiant macOS Articles

-

Sandbox Escape macOS for Office365

Primer on malware on macOS by Patrick Wardle

macOS Incident Response primer (2017)

Book in three parts about the macOS Kernel

Internals of macOS (2007)

Kernel Programming reference for macOS / iOS

Magazine for (macOS) Forensics

iOS Forensics Book

By Security Innovation

By David Thiel

By Kunal Relan

By Swaroop Yermalkar

By Jonathan Zdziarski

By Charlie Miller

X - macOS Security Researcher and Purple Teamer

X - Hungarian Researcher specialized on macOS Security

X - Founder of Objective-see, and Security Researcher

X - Security Researcher and Trainer of SANS 518 Course

GitHub - Developer of Mythic C2

X - macOS Security Researcher

X - DFIR Researcher, iLEAPP Developer

hackmd.io - Digital Forensics Investigator

Repository of old macOS Software

Older macOS Malware Catalogue

Malware Collection (various OS)

VX-Underground Malware Source Code

Malware Sourcecode collection (various OS)

Objective-See Malware

Malware Collection by Patrick Wardle

Lookup hardware specifications of every mac model

Blogpost on M1 Chipset Safe Mode

A primer on macOS Unified Log

Using the Unified Log for Incident Response

Improved process tree

Command Line Utilit(ies) to monitor processes and files

Collection of persistence methods and samples used

Displays persistence items in macOS

PersistentJXA

Collection of macOS persistence methods in JXA

Persistence Mechanisms

Process Tree

Process tree Repository

iOS FS Event Parser

Parsing filesystem events

FS Monitor to view live file system changes

macOS FS Events Parser

FS Events Parser

Mythic C2 Framework Documentation

VOODOO

Browser Attack Framework for macOS

SwiftSpy

macOS Keyloger written in Swift

A reverse engineering tool that will assist you in your static analysis of executable files

Ghidra

A software reverse engineering (SRE) framework created and maintained by the National Security Agency Research Directorate

Radare2

UNIX-like reverse engineering framework and command-line toolset

Cutter

Free and Open Source Reverse Engineering Platform powered by rizin

frida-ios-dump

A tool to pull a decrypted IPA from a jailbroken device

bagbak

Yet another frida based App decryptor. Requires jailbroken iOS device and frida.re

flexdecrypt

An iOS App & Mach-O binary decryptor

bfdecrypt

Utility to decrypt App Store apps on jailbroken iOS 11.x

bfinject

Easy dylib injection for jailbroken 64-bit iOS 11.0 - 11.1.2. Compatible with Electra and LiberiOS jailbreaks

r2flutch

Yet another tool to decrypt iOS apps using r2frida

Clutch

A high-speed iOS decryption tool

dsdump

An improved nm + objc/swift class-dump tool

class-dump

A command-line utility for examining the Objective-C segment of Mach-O files

SwiftDump

A command-line tool for retriving the Swift Object info from Mach-O file

An app inspector, disassembler, and signing utility for the macOS, iOS

An app to sideload your favorite games and apps to Jailbroken & Non-Jailbroken iOS devices

A GUI tool for sideloading iOS application

Allows to sideload other apps (.ipa files) onto iOS device

iOS App Signer

An app for macOS that can (re)sign apps and bundle them into ipa files that are ready to be installed on an iOS device

The only platform offering ARM-based mobile device virtualization using a custom-built hypervisor for real-world accuracy and high performance

Frida

Dynamic instrumentation toolkit for developers, reverse-engineers, and security researchers

frida-gum

Cross-platform instrumentation and introspection library written in C

Fridax

Fridax enables you to read variables and intercept/hook functions in Xamarin/Mono JIT and AOT compiled iOS/Android applications

r2frida

Radare2 and Frida better together

r2ghidra

An integration of the Ghidra decompiler for radare2

iproxy

A utility allows binding local TCP ports so that a connection to one (or more) of the local ports will be forwarded to the specified port (or ports) on a usbmux device

Use to forward SSH via USB

objection

A runtime mobile exploration toolkit, powered by Frida, built to help you assess the security posture of your mobile applications, without needing a jailbreak

Grapefruit

Runtime Application Instruments for iOS

Passionfruit

Simple iOS app blackbox assessment tool, powered by frida 12.x and vuejs

Runtime Mobile Security (RMS)

Runtime Mobile Security (RMS), powered by FRIDA, is a powerful web interface that helps you to manipulate Android and iOS Apps at Runtime

Dynamic memory analysis & visualisation tool for security researchers

unidbg

Allows you to emulate an Android ARM32 and/or ARM64 native library, and an experimental iOS emulation

Qiling

An advanced binary emulation framework

fishhook

A library that enables dynamically rebinding symbols in Mach-O binaries running on iOS

Dwarf

Full featured multi arch/os debugger built on top of PyQt5 and frida

FridaHookSwiftAlamofire

A frida tool that capture GET/POST HTTP requests of iOS Swift library 'Alamofire' and disable SSL Pinning

ios-deploy

Install and debug iOS apps from the command line. Designed to work on un-jailbroken devices

aah

Run iOS arm64 binaries on x86_64 macOS, with varying degrees of success

A next generation, high-performance debugger

A free and open source interactive HTTPS proxy

An advanced HTTPS proxy software

iLEAPP

An iOS Logs, Events, And Plist Parser

Keychain Dumper

A tool to check which keychain items are available to an attacker once an iOS device has been jailbroken

BinaryCookieReader

A tool to read the binarycookie format of Cookies on iOS applications

PList Viewer

Gtk application to view property list files

XMachOViewer

A Mach-O viewer for Windows, Linux and macOS

MachO-Explorer

A graphical Mach-O viewer for macOS. Powered by Mach-O Kit

A general file management software for iPhone and other Apple products

An All-in-One management software for iOS devices

An All-in-One solution for iOS devices management

FridaSwiftDump

A Frida script for retriving the Swift Object info from an running app

SSL Pinning Bypass for iOS 13

SSL Pinning Bypass for iOS 12

A Frida script used for bypass iOS jailbreak detection by hooking some methods and functions

Script for iOS app's static analysis

A Frida script for iOS Touch/Face ID Bypass

Advanced macOS Control Bypass Trainin by OffSec's @theevilbit

Forensics Training in two parts for macOS, to gain Certified Forensic Mac Examiner Certification

Course at SANS for macOS and iOS Forensics

Security Conference (macOS) organized by Patrick Wardle

SPECTEROPS macOS Adversary Tactics

By PentesterAcademy

By Mantis

By Sateesh Verma

By Noisy Hacker

JAMF 100 Youtube Playlist

Curated YouTube playlist with macOS/iOS Security Topics