iOS/macOS penetration testing cheatsheet

Action	macOS	Linux	Win	iOS w/JB
`MobSF`	MobSF	MobSF	MobSF	---
`Plist view`	plutil or Xcode	`apt-get install libplist-utils`	Plist Viewer	plutil
`Ghidra`	Ghidra	Ghidra	Ghidra	---
`Frida`	Frida	Frida	Frida	---
`Awesome Frida`	Awesome Frida	---	---	Awesome Frida
`Objection`	Objection	Objection	Objection	Objection
`Needle`	Needle	Needle	---	---
`Keychain dumper`	Keychain dumper	---	---	Keychain dumper
`iOS URL Schemes`	iOS URL Schemes	---	---	iOS URL Schemes
`Debug Hacks`	Debug Hacks	---	---	---
`SandBox Dumper`	SandBox Dumper	---	---	---
`PassionFruit`	PassionFruit	PassionFruit	---	---
`iPhoneTunnel`	iPhoneTunnel	---	iPhoneTunnel	---
`iRET`	iRET	---	---	---
`idb`	idb	idb	---	---
`XSecurity`	XSecurity	---	---	---

macOS Quick Look plugin for iOS & OSX developers

https://github.com/ealeksandrov/ProvisionQL – Generate amazing preview for .ipa .app .appex .mobileprovision .provisionprofile

Project/App	Swift	Objective-c
Swift Lint	+	-

Repos
http://cydia.iphonecake.com
http://apt.saurik.com/
http://repo.nesolabs.de/
https://build.frida.re/
http://appsec-labs.com/cydia/
http://cydia.zodttd.com/repo/cydia/
http://mobiletools.mwrinfosecurity.com/cydia/
http://repo666.ultrasn0w.com/
http://apt.thebigboss.org/repofiles/cydia/
http://cydia.radare.org/
http://apt.modmyi.com/
http://coolstar.org/publicrepo/
http://getdelta.co/ < Flex3 working
http://julioverne.github.io/
http://brunonfl.github.io/
http://apt.bingner.com/
http://repo.dynastic.co/
http://mcapollo.github.io/Public/
http://apt.hackcn.net/
http://repo.chariz.io/
http://cydia.ichitaso.com/
https://level3tjg.github.io < bfdecrypt (ios11/ios12)
http://ryleyangus.com/repo < Liberty Lite (beta) for JB bypas

Configure burp proxy on iOS device – Visit [your_proxy_adress]:[proxy_port]/mobileassistant.deb – Download file and install
- Via iFile
- Via ssh like `dpkg -i path/to/mobileassistant.deb
Respring
Launch Mobile Assistant
Add app in bottom panel
Turn-on switcher next to app
Launch your app
Congrats

More info here NB! in some cases you may face with lack of libraries, do not replace anything manually in iOS, it may lead to infinity loop)

Tool	Description	Link
`IPA Patch`	Xcode Project	IPA Patch
`Resign`	Xcode Project	Regisn

Name	Link
`Malware wellbeing on iOS devices`	Slides
`DVIA`	Homepage
`iGoat-Swift`	Homepage
`iOS-CTF`	Homepage
`Dynamic analysis of iOS apps w/o Jailbreak`	Article En Article RU & Slides
`Ro(o)tten Apples Vulnerability Heaven in the iOS Sandbox`	Slides
`Light and Dark side of Code Instrumentation`	Slides
`Комбайны безопасности для iOS и Android`	Slides

Do you want to add or fix? - Write to me or pull request!