ios-analyze-crypto-function-security
0 | 1K
Uploaded by: @sdcampbell
Analyze the security of iOS encryption and hashing operations. Run the script, use the application normally, then enter 'summary()' to print a security analysis.
Analyze the security of iOS encryption and hashing operations. Run the script, use the application normally, then enter 'summary()' to print a security analysis.
This dumps encryption ciphers for testing MASTG-TEST-0061: Verifying the Configuration of Cryptographic Standard Algorithms
When calculating prices for services, evaluations are made between the sales team and the technical team regarding the time required to complete the target mobile application. However, certain mobile applications, due to their structure, may extend the security testing process. For example, static security tests for a Flutter application with an enabled SSL module and a Cordova application without a client security module may require different working hours. In such cases, it would be useful to quickly detect which framework(s) the target application uses. To facilitate this, I developed a simple script with Frida that identifies the frameworks used by the target mobile application. In the future, I will also work on development for iOS.
IOS Application Information like application analyzer and memory dumper providing real-time inspection of app information, file system access, memory analysis, and runtime data extraction with an intuitive colored command-line interface
Apple BoringSSL Introspection
Get the constructors, fields, methods and overloads in a summarised way to quickly explore a class
Dump encrypted main.jsbundle at runtime
Not mine, tryna fix a bug
Dump encrypted index.android.bundle at runtime
test
Inspect WebView-related functions such as loadUrl(), shouldOverrideUrlLoading(), or onPageFinished(). For testing "MASTG-TEST-0027: Testing for URL Loading in WebViews"
This is used for testing "MASTG-TEST-0013/14/15/16: Testing Cryptography"
This is used for testing "MASTG-TEST-0005: Determining Whether Sensitive Data Is Shared with Third Parties via Notifications"
This script hooks into a function called IsDrived() which contains several private function.
This script traces functions typically related to vm and root detection to find what you need to hook to bypass root detection.
Ver dados do dispositivo em tempo de execucao