deardaniel/secdata-raw huggingface dataset:
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0050

---
title: Frida-ios-dump
platform: ios
source: https://github.com/AloneMonkey/frida-ios-dump
---

Frida-ios-dump is a Python script that helps you retrieve the decrypted version of an iOS app (IPA) from an iOS device. It supports both Python 2 and Python 3 and requires Frida running on your iOS device (jailbroken or not). This tool uses Frida's [Memory API](https://www.frida.re/docs/javascript-api/#memory "Frida Memory API") to dump the memory of the running app and recreate an IPA file. Because the code is extracted from memory, it is automatically decrypted.

## Alternatives

[Bagbak](https://github.com/ChiChou/bagbak "Bagbak") is a Node.js script that decrypts the entire application, including its extensions. It serves the same purpose as frida-ios-dump, but you might find it easier to set up and more convenient for regular use.
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0060

---
title: otool
platform: ios
source: https://www.unix.com/man_page/osx/1/otool/
---

otool is a tool for displaying specific parts of object files or libraries. It works with Mach-O files and universal file formats.
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0042

---
title: BinaryCookieReader
platform: ios
source: https://github.com/as0ler/BinaryCookieReader
---

BinaryCookieReader is a tool to dump all the cookies from the binary Cookies.binarycookies file - <https://github.com/as0ler/BinaryCookieReader/blob/master/BinaryCookieReader.py>
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0044

---
title: class-dump-z
platform: ios
source: https://code.google.com/archive/p/networkpx/wikis/class_dump_z.wiki
---

class-dump-z is class-dump re-written from scratch in C++, avoiding the use of dynamic calls. Removing these unnecessary calls makes class-dump-z nearly 10 times faster than its predecessor.
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0058

---
title: MachoOView
platform: ios
source: https://sourceforge.net/projects/machoview/
---

MachoOView is a useful visual Mach-O file browser that also allows in-file editing of ARM binaries.
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0136

---
title: plistlib
platform: ios
hosts: [macOS, windows, linux]
source: https://docs.python.org/3/library/plistlib.html
---

The plistlib is part of the Python standard library and allows you to programmatically read, modify, and write `.plist` (Property List) files. It supports both XML and binary plist formats and provides a native dictionary-based API.

This makes `plistlib` a cross-platform alternative to @MASTG-TOOL-0135, suitable for scripting or automation use cases.

## Reading a Plist File

The following example prints the contents of a plist file by loading it into a Python dictionary:

```python
import plistlib

with open("Info.plist", "rb") as f:
    plist = plistlib.load(f)

print(plist)
```

This prints a dictionary representation of the plist, which can be inspected and modified like any other Python dict.

## Reading Specific Plist Entries

After parsing the plist, you can access dictionary keys and array elements using regular Python syntax. The example below prints the third app icon format:

```python
print(plist["CFBundleIcons~ipad"]["CFBundlePrimaryIcon"]["CFBundleIconFiles"][2])
# Output: AppIcon-140x40
```

## Changing Plist Values

To modify an entry such as the `CFBundleDisplayName`, assign a new value and write the updated dict back to the file using `plistlib.dump`:

```python
plist["CFBundleDisplayName"] = "My New App Name"

with open("Info.plist", "wb") as f:
    plistlib.dump(plist, f)
```

## Adding and Deleting Plist Values

New keys can be added or removed using regular Python dict operations:

```python
# Add a new dictionary
plist["CustomDictionary"] = {"CustomProperty": "OWASP MAS"}

# Delete a key
del plist["CustomDictionary"]["CustomProperty"]

# Save the updated plist
with open("Info.plist", "wb") as f:
    plistlib.dump(plist, f)
```
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0102

---
title: ios-app-signer
platform: ios
source: https://github.com/DanTheMan827/ios-app-signer
alternatives:
- MASTG-TOOL-0114
- MASTG-TOOL-0117
---

ios-app-signer is a GUI-based tool for macOS that allows you to re-sign iOS apps and bundle them into IPA files ready to be installed on an iOS device. It can be installed using the `.app` file from the [GitHub releases](https://github.com/DanTheMan827/ios-app-signer/releases) or via brew on macOS:

```sh
brew install --cask ios-app-signer
```

For more information about installation and use, see their [website](https://dantheman827.github.io/ios-app-signer/).
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0062

---
title: Plutil
platform: ios
source: https://www.theiphonewiki.com/wiki/Plutil
---

Plutil is a program that can convert .plist files between a binary version and an XML version.
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0066

---
title: SSL Kill Switch 3
platform: ios
source: https://github.com/NyaMisty/ssl-kill-switch3
---

SSL Kill Switch 3 is a jailbreak tweak to disable SSL certificate validation - including certificate pinning - within iOS and macOS Apps
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0045

---
title: class-dump-dyld
platform: ios
source: https://github.com/limneos/classdump-dyld
---

class-dump-dyld allows symbols to be dumped and retrieved directly from the shared cache, eliminating the necessity of extracting the files first. It can generate header files from app binaries, libraries, frameworks, bundles, or the whole dyld_shared_cache. Directories or the entirety of dyld_shared_cache can be recursively mass-dumped.
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0040

---
title: MobSF (iOS)
platform: ios
source: https://github.com/MobSF/Mobile-Security-Framework-MobSF
---

By running MobSF locally on a macOS host you'll benefit from a slightly better class-dump output.

Once you have MobSF up and running you can open it in your browser by navigating to <http://127.0.0.1:8000>. Simply drag the IPA you want to analyze into the upload area and MobSF will start its job.

After MobSF is done with its analysis, you will receive a one-page overview of all the tests that were executed. The page is split up into multiple sections giving some first hints on the attack surface of the application.

<img src="Images/Chapters/0x06b/mobsf_ios.png" width="100%" />

The following is displayed:

- Basic information about the app and its binary file.
- Some options to:
    - View the `Info.plist` file.
    - View the strings contained in the app binary.
    - Download a class-dump, if the app was written in Objective-C; if it is written in Swift no class-dump can be created.
- List all Purpose Strings extracted from the `Info.plist` which give some hints on the app's permissions.
- Exceptions in the App Transport Security (ATS) configuration will be listed.
- A brief binary analysis showing if free binary security features are activated or e.g. if the binary makes use of banned APIs.
- List of libraries used by the app binary and list of all files inside the unzipped IPA.

> In contrast to the Android use case, MobSF does not offer any dynamic analysis features for iOS apps.

Refer to [MobSF documentation](https://mobsf.github.io/docs "MobSF documentation") for more details.
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0137

---
title: GlobalWebInspect
platform: ios
source: https://github.com/ChiChou/GlobalWebInspect
hosts: [ios]
---

!!! warning

    This tool may or may not work depending on your macOS / iOS combination.

GlobalWebInspect can be installed on a jailbroken iOS device to enable Safari Web Inspector attachment to `WKWebView` and JavaScriptCore web content in apps that would not normally expose it. You can install the tweak by copying the package to your device and running `sudo dpkg -i <file>.deb`, or by installing it through a jailbreak package manager. It requires a MobileSubstrate compatible hooking environment, such as @MASTG-TOOL-0139.

## How it works

On iOS 16.4 and later, GlobalWebInspect hooks creation of `WKWebView` and `JSContext` related objects, then forcibly turns inspection on. In the project's own code and README, it says it hooks `WKWebView` creation and `JSContext`, and the implementation shows it calling `setInspectable:` on `WKWebView` during `-[WKWebView _initializeWithConfiguration:]`, and calling `JSGlobalContextSetInspectable(..., true)` for JavaScriptCore contexts.

For older iOS versions, the mechanism is different. The README says `webinspectord` checks certain entitlements before listing a process as inspectable, including `com.apple.security.get-task-allow` and several Web Inspector related entitlements. GlobalWebInspect injects into `webinspectord` and returns `true` for those entitlement queries, so apps that would normally be rejected still appear to Safari Web Inspector.
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0121

---
title: objdump (iOS)
platform: ios
source: https://llvm.org/docs/CommandGuide/llvm-objdump.html
alternatives:
- MASTG-TOOL-0041
---

objdump is a tool to inspect object files, executables and libraries. It can disassemble instructions or show symbol tables, headers and sections. There are implementations in [GNU Binutils](https://www.gnu.org/s/binutils/) and in [LLVM](https://llvm.org/).
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0128

---
title: Filza
platform: ios
hosts: [ios]
source: https://tigisoftware.com/cydia/
---

Filza is a file manager for jailbroken iOS devices. It can be installed by adding the [Tigisoftware repo](https://tigisoftware.com/repo/) to your package manager and searching for Filza.

In addition to letting you browse the file system, you can also use Filza to easily install IPA files. Simply navigate to the IPA file on your filesystem, and click on `Install` in the top right corner.
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0043

---
title: class-dump
platform: ios
source: https://github.com/nygard/class-dump
---

class-dump is a command line utility for examining the Objective-C runtime information stored in Mach-O (Mach object) files. It generates declarations for the classes, categories, and protocols.

The official release of the tool only works in macOS, but an unofficial [dockerized version](https://github.com/lucacapacci/class-dump-docker) is also available, allowing for use across different environments.
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0051

---
title: gdb
platform: ios
status: deprecated
deprecation_note: While GDB is actively developed (see https://www.sourceware.org/gdb/), it is not compatible with recent iOS versions or jailbreaks. Apple has also dropped support for GDB in favor of LLDB.
source: https://github.com/swigger/gdb-ios
covered_by: [MASTG-TOOL-0057]

---

A tool to perform runtime analysis of iOS applications.
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0072

---
title: xcrun
platform: ios
source: https://www.unix.com/man-page/osx/1/xcrun/
---

xcrun can be used invoke Xcode developer tools from the command-line, without having them in the path. For example you may want to use it to locate and run swift-demangle or simctl.
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0126

---
title: libimobiledevice suite
platform: ios
hosts: [macOS, windows, linux]
source: https://libimobiledevice.org/
---

The libimobiledevice suite is cross-platform protocol library for interacting with iOS devices. The different libraries can be compiled into binaries for direct interaction with iOS devices from the command line.

!!! warning

    While many package repositories (apt, brew, cargo, ...) have versions of libimobiledevice tools, they are often outdated. We recommend compiling the different tools from source for the best results. Note that even if your package manager has the latest version based on `-v`, the source code will still be more up-to-date.

The following tools are part of the libimobiledevice suite:

| Tool | Purpose |
| --- | --- |
| idevice_id | List attached devices or print device name of given device. |
| idevicebackup | Create or restore backup from the current or specified directory (<iOS 4). |
| idevicebackup2 | Create or restore backup from the current or specified directory (>= iOS 4). |
| idevicecrashreport | Move crash reports from device to a local DIRECTORY. |
| idevicedate | Display the current date or set it on a device. |
| idevicedebug | Interact with the debugserver service of a device. |
| idevicedebugserverproxy | Proxy debugserver connection from device to a local socket at PORT. |
| idevicediagnostics | Use diagnostics interface of a device running iOS 4 or later. |
| ideviceenterrecovery | Makes a device with the supplied UDID enter recovery mode immediately. |
| ideviceimagemounter | Mounts the specified disk image on the device. |
| ideviceinfo | Show information about a connected device. |
| ideviceinstaller | Manage apps on iOS devices. |
| idevicename | Display the device name or set it to NAME if specified. |
| idevicenotificationproxy | Post or observe notifications on a device. |
| idevicepair | Manage host pairings with devices and usbmuxd. |
| ideviceprovision | Manage provisioning profiles on a device. |
| idevicescreenshot | Gets a screenshot from a device. |
| idevicesetlocation | Sets the location on a device. |
| idevicesyslog | Relay syslog of a connected device. |
| inetcat | Opens a read/write interface via STDIN/STDOUT to a TCP port on a usbmux device. |
| iproxy | Proxy that binds local TCP ports to be forwarded to the specified ports on a usbmux device. |
| plistutil | Convert a plist FILE between binary, XML, JSON, and OpenStep format. |
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0139

---
title: ElleKit
platform: ios
source: https://github.com/tealbathingsuit/ellekit
---

ElleKit is a function-hooking framework used by the popular jailbreaks Dopamine and palera1n. It provides an API for both Substrate and libhooker.

Tweaks installed via @MASTG-TOOL-0064 will often use ElleKit to alter the behavior of an app by modifying function arguments, return values of implementations, as described in @MASTG-TECH-0067.
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0056

---
title: Keychain-Dumper
platform: ios
source: https://github.com/ptoomey3/Keychain-Dumper
---

Keychain-dumper is an iOS tool to check which keychain items are available to an attacker once an iOS device has been jailbroken. In order to use the tool on modern versions of iOS, you need to follow a few steps. First, download the latest release from [the Keychain-Dumper releases page](https://github.com/ptoomey3/Keychain-Dumper/releases), and unzip the package. Next, download the [updateEntitlements.sh](https://raw.githubusercontent.com/ptoomey3/Keychain-Dumper/refs/heads/master/updateEntitlements.sh) script to the same directory. Modify the first line (`KEYCHAIN_DUMPER_FOLDER=/usr/bin`) to say `KEYCHAIN_DUMPER_FOLDER=/var/jb/usr/bin` to be compatible with rootless jailbreaks. If your device has a rooted jailbreak (e.g. palera1n) you can skip this step.

```bash
# Copy over the binary to /var/jb/usr/bin/
scp keychain_dumper mobile@<deviceip>:/var/jb/usr/bin/

# Copy over the updateEntitlements.sh script
scp updateEntitlements.sh mobile@<deviceip>:/var/jb/usr/bin/

# SSH into the device
ssh mobile@<deviceip>

# Go to the /var/jb/tmp directory and switch to root
cd /var/jb/usr/bin & sudo su

# Add executable permissions to both files
chmod +x keychain_dumper
chmod +x updateEntitlements.sh

# Run updateEntitlements.sh
./updateEntitlements.sh

# Run keychain_dumper
/var/jb/tmp/keychain_dump -h
```

By default, the script will give keychain_dump all the required entitlements to analyze the KeyChain for all installed applications. To focus on a single application, you can remove all unnecessary requirements:

```bash
# Extract entitlements
ldid -e /var/jb/tmp/keychain_dump > ent.xml

# Remove all non-needed entitlements from the <array> segment
nano ent.xml

# Assign the entitlements again
ldid -Sent.xml /var/jb/tmp/keychain_dump
```

For usage instructions please refer to the [Keychain-dumper](https://github.com/mechanico/Keychain-Dumper "keychain-dumper") GitHub page.
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0064

---
title: Sileo
platform: ios
source: https://github.com/Sileo/Sileo
---

Sileo is a third-party app store available for both rooted and rootless jailbreaks on iOS 12+. It provides a graphical user interface for `apt/dpkg` and lets you install apps, binaries, and tweaks. Sileo is packaged with popular jailbreaks such as Dopamine and palera1n.

!!! Warning "Installing apps"

    Installing applications via Sileo or any other third-party app store carries risks, as Apple does not validate them. Be careful when installing unknown applications.

Many jailbreak tools can be installed using Sileo. By default, Sileo has some package repositories configured. You can add new repositories by navigating to **Sources** -> **Edit**, then clicking **Add** in the top left.

Some helpful tools that can be installed this way:

- @MASTG-TOOL-0039
- @MASTG-TOOL-0066
- @MASTG-TOOL-0137
- @MASTG-TOOL-0127

<img src="Images/Tools/TOOL-0064-Sileo.png" width="400px" />
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0141

---
title: IOSSecuritySuite
platform: ios
source: https://github.com/securing/IOSSecuritySuite
---

IOSSecuritySuite is a library used to detect if a device is jailbroken.
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0071

---
title: Xcode Command Line Tools
platform: ios
source: https://developer.apple.com/download/more/
---

The Xcode Command Line Tools are bundled with @MASTG-TOOL-0070. After installing @MASTG-TOOL-0070, run `xcode-select --install` to install the Xcode Command Line Tools package. This will be handy during testing of iOS apps as some of the tools (e.g. objection) are also relying on the availability of this package. Alternatively, you can [download the tools from the official Apple website](https://developer.apple.com/download/more/ "Apple iOS SDK").
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0055

---
title: iproxy
platform: ios
hosts: [macOS, windows, linux]
source: https://github.com/libimobiledevice/libusbmuxd
---

iproxy allows you to forward a port from a connected iOS device to a port on the host machine. This can be useful for interacting with jailbroken devices, as some jailbreaks do not expose the SSH port on the public interface. With `iproxy`, the SSH port can be forwarded over USB to the host, allowing you to still connect to it.

!!! warning

    While many package repositories (apt, brew, cargo, ...) have versions of libimobiledevice tools, they are often outdated. We recommend compiling the different tools from source for the best results.
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0053

---
title: iOSbackup
platform: ios
source: https://github.com/avibrazil/iOSbackup
---

iOSbackup is a Python 3 class that reads and extracts files from a password-encrypted iOS backup created by iTunes on Mac and Windows.
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0065

---
title: simctl
platform: ios
source: https://developer.apple.com/download/more/

---

simctl is an Xcode tool that allows you to interact with iOS simulators via the command line to e.g. manage simulators, launch apps, take screenshots or collect their logs.
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0069

---
title: Usbmuxd
platform: ios
source: https://github.com/libimobiledevice/usbmuxd
---

usbmuxd is a socket daemon that monitors USB iPhone connections. You can use it to map the mobile device's localhost listening sockets to TCP ports on your host computer. This allows you to conveniently SSH into your iOS device without setting up an actual network connection. When usbmuxd detects an iPhone running in normal mode, it connects to the phone and begins relaying requests that it receives via `/var/run/usbmuxd`.
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0054

---
title: ios-deploy
platform: ios
source: https://github.com/ios-control/ios-deploy
---

With ios-deploy you can install and debug iOS apps from the command line, without using Xcode. It can be installed via brew on macOS:

```bash
brew install ios-deploy
```

Alternatively:

```bash
git clone https://github.com/ios-control/ios-deploy.git
cd ios-deploy/
xcodebuild
cd build/Release
./ios-deploy
ln -s <your-path-to-ios-deploy>/build/Release/ios-deploy /usr/local/bin/ios-deploy
```

The last line creates a symbolic link and makes the executable available system-wide. Reload your shell to make the new commands available:

```bash
zsh: # . ~/.zshrc
bash: # . ~/.bashrc
```
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0118

---
title: Sideloadly
platform: ios
hosts: [windows, macOS]
source: https://sideloadly.io/
---

Sideloadly allows you to obtain a valid signature for a given IPA file and then install it to a connected iOS device. In addition to signing and installing an IPA file, Sideloadly also allows you to inject tweaks, change the App or Bundle name or make other limited modifications to the IPA metadata. Sideloadly is available on both macOS and Windows.

!!! warning "Do not use your personal Apple account"
    To sign an IPA file, you will need a valid iOS developer account, either free or paid. Both types come with certain restrictions, as explained in @MASTG-TECH-0079. We recommend creating a dedicated developer account for signing test applications, and **not** using your personal Apple account.
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0041

---
title: nm (iOS)
platform: ios
source: https://www.unix.com/man-page/osx/1/nm/
---

nm is a tool that displays the name list (symbol table) of the given binary.
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0111

---
title: ldid
platform: ios
source: https://github.com/ProcursusTeam/ldid
hosts: [windows, linux, macOS]
---

ldid is a Link Identity Editor created by Saurik. It allows you to view and update the entitlements of a MachO binary.

The original source from [Jay Freeman (saurik)](https://saurik.com/) is not available anymore, while precompiled versions are available from the [ProcursusTeam's repo](https://github.com/ProcursusTeam/ldid).
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0049

---
title: Frida-cycript
platform: ios
source: https://github.com/nowsecure/frida-cycript
---

Frida-cycript is a fork of Cycript including a brand new runtime called Mjølner powered by Frida. This enables frida-cycript to run on all the platforms and architectures maintained by frida-core.