deardaniel/secdata-raw huggingface dataset:
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0035

---
title: MobSF
platform: generic
source: https://github.com/MobSF/Mobile-Security-Framework-MobSF
---

MobSF (Mobile Security Framework) is an automated, all-in-one mobile application pentesting framework capable of performing static and dynamic analysis. The easiest way of getting MobSF started is via Docker.

```bash
docker pull opensecurity/mobile-security-framework-mobsf
docker run -it -p 8000:8000 opensecurity/mobile-security-framework-mobsf:latest
```

Or install and start it locally on your host computer by running:

```bash
# Setup
git clone https://github.com/MobSF/Mobile-Security-Framework-MobSF.git
cd Mobile-Security-Framework-MobSF
./setup.sh # For Linux and Mac
setup.bat # For Windows

# Installation process
./run.sh # For Linux and Mac
run.bat # For Windows
```

Once you have MobSF up and running you can open it in your browser by navigating to <http://127.0.0.1:8000>. Simply drag the APK you want to analyze into the upload area and MobSF will start its job.
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0033

---
title: Ghidra
platform: generic
source: https://github.com/NationalSecurityAgency/ghidra
---

Ghidra is an open source software reverse engineering (SRE) suite of tools developed by the United State of America's National Security Agency's (NSA) Research Directorate. Ghidra is a versatile tool which comprises of a disassembler, decompiler and a built-in scripting engine for advanced usage. Please refer to the [installation guide](https://ghidra-sre.org/InstallationGuide.html "Ghidra Installation Guide") on how to install it and also look at the [cheat sheet](https://ghidra-sre.org/CheatSheet.html "Cheat Sheet") for a first overview of available commands and shortcuts. In this section, we will have walk-through on how to create a project, view disassembly and decompiled code for a binary.

Start Ghidra using `ghidraRun` (\*nix) or `ghidraRun.bat` (Windows), depending on the platform you are on. Once Ghidra is fired up, create a new project by specifying the project directory. You will be greeted by a window as shown below:

<img src="Images/Chapters/0x04c/Ghidra_new_project.png" width="100%" />

In your new **Active Project** you can import an app binary by going to **File** -> **Import File** and choosing the desired file.

<img src="Images/Chapters/0x04c/Ghidra_import_binary.png" width="100%" />

If the file can be properly processed, Ghidra will show meta-information about the binary before starting the analysis.

<img src="Images/Chapters/0x04c/Ghidra_elf_import.png" width="100%" />

To get the disassembled code for the binary file chosen above, double click the imported file from the **Active Project** window. Click **yes** and **analyze** for auto-analysis on the subsequent windows. Auto-analysis will take some time depending on the size of the binary, the progress can be tracked in the bottom right corner of the code browser window. Once auto-analysis is completed you can start exploring the binary.

<img src="Images/Chapters/0x04c/Ghidra_main_window.png" width="100%" />

The most important windows to explore a binary in Ghidra are the **Listing** (Disassembly) window, the **Symbol Tree** window and the **Decompiler** window, which shows the decompiled version of the function selected for disassembly. The **Display Function Graph** option shows control flow graph of the selected function.

<img src="Images/Chapters/0x04c/Ghidra_function_graph.png" width="100%" />

There are many other functionalities available in Ghidra and most of them can be explored by opening the **Window** menu. For example, if you want to examine the strings present in the binary, open the **Defined Strings** option. We will discuss other advanced functionalities while analyzing various binaries for Android and iOS platforms in the coming chapters.

<img src="Images/Chapters/0x04c/Ghidra_string_window.png" width="100%" />
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0144

---
title: gitleaks
platform: generic
source: https://github.com/gitleaks/gitleaks
---

gitleaks is a fast, open-source secrets scanner for files, directories, and git history. It detects hardcoded credentials such as API keys, tokens, and private keys using robust pattern rules and entropy heuristics.

Typical uses in mobile app testing include scanning dynamic analysis outputs (e.g., logs, detailed method traces, network traffic, app files) to quickly surface potential secrets written in cleartext, as well as auditing repositories of mobile projects.

Refer to the official documentation for installation and usage instructions.
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0037

---
title: RMS Runtime Mobile Security
platform: generic
source: https://github.com/m0bilesecurity/RMS-Runtime-Mobile-Security
---

RMS Runtime Mobile Security is a runtime mobile application analysis toolkit, supporting Android and iOS Apps. It offers a web GUI and is written in Python.

It's leveraging a running Frida server on a jailbroken device with the following out-of-box functionalities:

- Execute popular Frida scripts
- Execute custom Frida scripts
- Dump all the loaded classes and relative methods
- Hook methods on the fly
- (Android) Monitor Android APIs and usage of native APIs

The installation instructions and "how-to guide" of RMS can be found in the [Readme of the Github repo](https://github.com/m0bilesecurity/RMS-Runtime-Mobile-Security "Github Repo of RMS").
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0101

---
title: disable-flutter-tls-verification
platform: generic
source: https://github.com/NVISOsecurity/disable-flutter-tls-verification
---

disable-flutter-tls-verification is a Frida script that disables Flutter's TLS verification and works on (ARM32, ARM64 and x64) and iOS (ARM64). It uses pattern matching to find [ssl_verify_peer_cert in handshake.cc](https://github.com/google/boringssl/blob/master/ssl/handshake.cc#L323). Further information can be found in [this blog post](https://blog.nviso.eu/2022/08/18/intercept-flutter-traffic-on-ios-and-android-http-https-dio-pinning/).

You can use it via @MASTG-TOOL-0032 or by downloading disable-flutter-tls.js from the repo as indicated in these [instructions](https://github.com/NVISOsecurity/disable-flutter-tls-verification).
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0108

---
title: Corellium
platform: generic
source: https://corellium.com
---

Corellium is an iOS and Android device virtualization platform that allows users to create and manage virtual devices, perform dynamic analysis, and test applications in a controlled environment.

## Overview

Corellium offers a cloud-based solution that enables users to run virtualized iOS and Android devices. These virtual devices can be used for various purposes, including security testing, app development, and research. Corellium provides a web-based interface for managing the virtual devices, as well as APIs for automation and integration with other tools.

The Corellium GUI provides an app overview and app installer and many other features that are interesting for security testing, such as:

- [Built-in file browser](https://support.corellium.com/features/files/)
- [Built-in Frida server](https://support.corellium.com/features/frida/)
- [Snapshot management](https://support.corellium.com/features/snapshots)
- [Network monitor](https://support.corellium.com/features/network-monitor/)

## iOS emulation

Corellium is the only available commercial option for [iOS emulation](https://support.corellium.com/devices/ios). It is possible to launch all types of iOS devices with any supported iOS version. Each device can be jailbroken from the start, so even recent versions of iOS can be used to analyze applications.

While Corellium has some very powerful tools to analyze both applications and iOS itself, it does have a few important limitations:

- **No App Store**: The devices do not have the App Store, which means you cannot use a Corellium device to obtain a decrypted version of an IPA file.
- **No Apple Services**: Access to Apple services (including iMessage and push notifications) is unavailable.
- **No Camera / Cellular / NFC / Bluetooth**: Apps running on Corellium do not have access to these peripherals. But it does support [simulated SMS sending](https://support.corellium.com/features/messaging).

More on iOS testing can be found [in Corellium's iOS testing documentation](https://support.corellium.com/features/apps/testing-ios-apps).

## Android emulation

[Android emulation](https://support.corellium.com/devices/android) is available in both the `user` and `userdebug` configuration and all images are rooted by default. Google Play and other Google Services are not installed by default, but Corellium does allow you to install them via an [OpenGApps](https://support.corellium.com/features/apps/opengapps) package. [Bluetooth](https://support.corellium.com/features/apps/bluetooth) is supported.

However, some features are not supported:

- **TrustZone**: It is not possible to access a Keymaster, or use PlayReady or Widevine.
- **SELinux in Permissive mode**: SELinux is set to permissive mode, which may be detected by applications. This is typically not the case for physical devices rooted with Magisk or KernelSU.

More on Android testing can be found [in Corellium's Android testing documentation](https://support.corellium.com/features/apps/debug-test-android-apps).
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0131

---
title: dependency-check
platform: generic
source: https://github.com/jeremylong/DependencyCheck
---

Dependency-Check is a Software Composition Analysis (SCA) tool that attempts to detect publicly disclosed vulnerabilities contained within a project's dependencies.

However, SCA tools like Dependency-Check have their limitations. For example, they usually fail to scan IPA or APK files. There are two main reasons for this:

- **Transformed format**: The libraries are no longer in their original format, but rather, they are part of the app's compiled binary code. For instance, an Android app does not contain third-party JAR files in the APK because they are part of the compiled DEX files.
- **Lack of metadata**: Information such as the library version or name is often stripped or altered when building the mobile app.

Therefore, Dependency-Check is best used in a gray-box environment where the source code or at least the build configuration files are available. In this case, the tool can analyze the build configuration files to identify dependencies and their versions. For example:

- For iOS, the `Podfile` for CocoaPods or `Cartfile` for Carthage can be scanned to identify the dependencies used in the app.
- For Android, scan the `build.gradle` files to identify the dependencies used in the app.
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0100

---
title: reFlutter
platform: generic
source: https://github.com/Impact-I/reFlutter
---

The reFlutter framework helps to reverse engineer Flutter apps using the patched version of the Flutter library, which is already compiled and ready for application repackaging. This library has a modified snapshot deserialization process that allows you to perform dynamic analysis. reFlutter can also be used for intercepting Flutter HTTPS traffic.

You can install and use reFlutter by following [the official instructions](https://github.com/Impact-I/reFlutter?tab=readme-ov-file#install). More information is also available in the article ["Fork Bomb for Flutter"](https://swarm.ptsecurity.com/fork-bomb-for-flutter/) including details and practical examples.
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0098

---
title: iaito
platform: generic
source: https://github.com/radareorg/iaito
---

Iaito is the official graphical user interface for radare2, an open-source reverse engineering framework. This user-friendly tool simplifies the reverse engineering process by providing a graphical interface that integrates seamlessly with radare2's powerful features. With a focus on simplicity, keybindings, and radare2-style workflows, Iaito is a valuable resource for both experienced reverse engineers and those new to the field, offering a more accessible and efficient way to work with radare2.
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0110

---
title: semgrep
platform: generic
source: https://github.com/semgrep/semgrep
---

semgrep is a static code scanner that is able to scan Java, Kotlin and Swift.
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0133

---
title: Visual Studio Code (vscode)
platform: generic
source: https://github.com/microsoft/vscode
---

Visual Studio Code (vscode) is a code editor that offers various plugins useful for development and security testing. For example:

- [SARIF Viewer](https://marketplace.visualstudio.com/items?itemName=MS-SarifVSCode.sarif-viewer): to work with and visualise SARIF files.
- [Swift](https://marketplace.visualstudio.com/items?itemName=sswg.swift-lang): for syntax support for the Swift programming language.
- [Kotlin](https://marketplace.visualstudio.com/items?itemName=mathiasfrohlich.Kotlin): for syntax support for the Kotlin programming language.
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0129

---
title: rabin2
platform: generic
source: https://github.com/radareorg/radare2
---

rabin2 is a command-line utility within the Radare2 framework (@MASTG-TOOL-0073, @MASTG-TOOL-0028) designed for extracting and presenting detailed information from binary files. It supports various file formats, including Java CLASS, ELF, PE, Mach-O, and others through plugins. Rabin2 can retrieve data such as symbol imports/exports, library dependencies, data section strings, cross-references, entry point addresses, sections, and architecture types. The extracted information can be output in multiple formats compatible with other tools, including Radare2 itself.
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0145

---
title: Frooky
platform: generic
source: https://github.com/cpholguera/frooky
hosts: [ windows, linux, macOS ]
---

Frooky is a Frida-based dynamic analysis tool for Android and iOS applications. It enables security researchers to instrument mobile apps using JSON-based hook configurations, providing a declarative approach to method interception without writing custom Frida scripts.

## Capabilities

- Hook Java/Kotlin methods and native C/C++ functions
- Support for method overloads with specific argument signatures
- Stack trace capture with configurable depth
- Flexible argument decoding for multiple data types
- Conditional hook triggering based on argument values or stack patterns
- JSON Lines (NDJSON) output format for streamlined data processing
- Support for multiple hook files that get merged together

## Installation

Frooky requires Python 3.10 or later. Install via pip:

```bash
pip install frooky // pip3, or pipx
```

## Usage

Attach to an already running app:

```bash
frooky -U -n "My App" --platform android hooks.json
```

Spawn and instrument an app:

```bash
frooky -U -f com.example.app --platform android storage.json crypto.json
```

Refer to the [official documentation](https://github.com/cpholguera/frooky#usage) for more details on command-line options and configuration.
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0104

---
title: hermes-dec
platform: generic
source: https://github.com/P1sec/hermes-dec/
---

Hermes-dec is a tool for reverse-engineering compiled [hermes](https://reactnative.dev/docs/hermes) bytecode for both Android and iOS apps. It supports decompilation and disassembly of Hermes VM bytecode (HBC) format, typically seen in apps developed in [React Native](https://reactnative.dev/).

If you encounter either of the following files during static analysis, hermes-dec provides a way to recover a legible version of the file's contents:

- index.android.bundle
- main.jsbundle

Use `file` to check the type and confirm you are dealing with actual Hermes bytecode:

```bash
$ file main.jsbundle
main.jsbundle: Hermes JavaScript bytecode, version 90
```

If instead you see that it's a plain text file, it can be opened with any text editor and hermes-dec isn't needed:

```bash
$ file main.jsbundle
main.jsbundle: Unicode text, UTF-8 text
```

You can try using hermes-dec in situations where you are doing static analysis on a React Native mobile app, and [react-native-decompiler](https://github.com/numandev1/react-native-decompiler) fails.
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0038

---
title: objection
platform: generic
source: https://github.com/sensepost/objection
---

Objection is a "runtime mobile exploration toolkit, powered by Frida". Its main goal is to allow security testing on non-rooted devices through an intuitive interface. You can find the [full list of features](https://github.com/sensepost/objection/wiki/Features) on the project's page, but here are a few platform-agnostic ones:

- Access application storage to download or upload files
- Execute custom Frida scripts
- Search, replace and dump memory
- Job control to unload hooks and scripts
- Interact with SQLite databases inline
- Support for custom plugins

Objection achieves this goal by providing you with the tools to easily inject the Frida gadget into an application by repackaging it. This way, you can deploy the repackaged app to the non-rooted/non-jailbroken device by sideloading it. Objection also provides a REPL that allows you to interact with the application, giving you the ability to perform any action that the application can perform.

Objection can be installed through pip as described on [Objection's Wiki](https://github.com/sensepost/objection/wiki/Installation "Objection Wiki - Installation").

```bash
pip3 install objection
```

If the pip version is out of sync with the latest release or you want to use the latest development version, you can install Objection directly from the source repository's main branch. See [Development Environment Installation](https://github.com/sensepost/objection/wiki/Development-Environment-Installation) for instructions.
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0061

---
title: Grapefruit
platform: ios
source: https://github.com/ChiChou/grapefruit
---

Grapefruit is an iOS app assessment tool that is using the Frida server on the iOS device and is abstracting many penetration testing tasks into a Web UI. It can be installed via `npm`.

```bash
$ npm install -g igf
$ grapefruit
listening on http://localhost:31337
```

When you execute the command `grapefruit` a local server will be started on port 31337. Connect your jailbroken device with the Frida server running, or a non-jailbroken device with a repackaged app including Frida to your machine via USB. Once you click on the "iPhone" icon you will get an overview of all installed apps.

With Grapfruit it's possible to explore different kinds of information concerning an iOS app. Once you selected the iOS app you can perform many tasks such as:

- Get information about the binary
- View folders and files used by the application and download them
- Inspect the Info.plist
- Get a UI Dump of the app screen shown on the iOS device
- List the modules that are loaded by the app
- Dump class names
- Dump keychain items
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0138

---
title: ipainstaller
platform: ios
source: https://github.com/autopear/ipainstaller
---

ipainstaller allows you to install IPA files from an SSH session on a jailbroken iOS device.
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0067

---
title: swift-demangle
platform: ios
source: https://developer.apple.com/download/more/
---

swift-demangle is an Xcode tool that demangles Swift symbols. For more information run `xcrun swift-demangle -help` once installed.
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0059

---
title: optool
platform: ios
source: https://github.com/alexzielenski/optool
---

optool is a tool which interfaces with MachO binaries in order to insert/remove load commands, strip code signatures, resign, and remove aslr.

To install it:

```bash
git clone https://github.com/alexzielenski/optool.git
cd optool/
git submodule update --init --recursive
xcodebuild
ln -s <your-path-to-optool>/build/Release/optool /usr/local/bin/optool
```

The last line creates a symbolic link and makes the executable available system-wide. Reload your shell to make the new commands available:

```bash
zsh: # . ~/.zshrc
bash: # . ~/.bashrc
```
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0063

---
title: security
platform: ios
source: https://ss64.com/osx/security.html
---

security is a macOS command to administer Keychains, keys, certificates and the Security framework.
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0070

---
title: Xcode
platform: ios
source: https://developer.apple.com/xcode/ide/
---

Xcode is an Integrated Development Environment (IDE) for macOS that contains a suite of tools for developing software for macOS, iOS, watchOS, and tvOS. You can [download Xcode for free from the official Apple website](https://developer.apple.com/xcode/ide/ "Apple Xcode IDE"). Xcode will offer you different tools and functions to interact with an iOS device that can be helpful during a penetration test, such as analyzing logs or sideloading of apps.
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0114

---
title: codesign
platform: ios
source: https://www.unix.com/man-page/osx/1/codesign/
alternatives:
- MASTG-TOOL-0102
- MASTG-TOOL-0117
---

The codesign tool is primarily used to create, verify, and display code signatures, and to query the dynamic status of signed code in the system. Although Xcode typically automates the process of signing code during builds and before distribution, there are scenarios where manual intervention with codesign is required. This can include inspecting or verifying the details of an app's code signature, or manually re-signing an app. For more detailed tasks such as these, you can use the codesign command line tool directly, as described in Apple's Code Signing Guide.

Learn more:

- ["Examining a Code Signature"](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Procedures/Procedures.html#//apple_ref/doc/uid/TP40005929-CH4-SW10)
- ["Signing Code Manually"](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Procedures/Procedures.html#//apple_ref/doc/uid/TP40005929-CH4-SW3) in Apple's Code Signing Guide
- [Using the latest code signature format](https://developer.apple.com/documentation/xcode/using-the-latest-code-signature-format)
- [codesign manpage](https://www.unix.com/man-page/osx/1/codesign/)
- [codesign source code](https://github.com/apple-oss-distributions/Security/blob/main/SecurityTool/sharedTool/codesign.c)
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0142

---
title: Choicy
platform: ios
source: https://github.com/opa334/Choicy
---

Choicy is an advanced tweak configurator for jailbroken iOS devices. It allows you to prevent injection of tweaks into specific applications, which can help with hiding the jailbroken nature of the device.
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0122

---
title: c++filt
platform: ios
source: https://www.gnu.org/software/binutils/
hosts: [macOS, windows, linux]
---

c++filt is a demangling tool that converts mangled C++ symbols into human readable strings by calling `c++filt <symbol>`. See [the man page](https://ftp.gnu.org/old-gnu/Manuals/binutils-2.12/html_node/binutils_11.html "c++filt") for more information on its usage.