diff --git a/.github/workflows/lint.xml b/.github/workflows/lint.xml new file mode 100644 index 0000000..b0b370c --- /dev/null +++ b/.github/workflows/lint.xml @@ -0,0 +1,35 @@ +This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. +# This workflow will download a prebuilt Ruby version, install dependencies and run tests with Rake +# For more information see: https://github.com/marketplace/actions/setup-ruby-jruby-and-truffleruby + +name: Lint + +on: + push: + branches: [ master ] + pull_request: + branches: [ master ] + +jobs: + test: + + runs-on: ubuntu-latest + + steps: + - uses: actions/checkout@v2 + - name: Set up Ruby + # To automatically get bug fixes and new Ruby versions for ruby/setup-ruby, + # change this to (see https://github.com/ruby/setup-ruby#versioning): + # uses: ruby/setup-ruby@v1 + uses: ruby/setup-ruby@v1 + with: + ruby-version: 2.6 + - name: Install dependencies + run: gem install mdl + - name: Run tests + run: | + # Lint - disable some rules - https://github.com/markdownlint/markdownlint/blob/master/docs/RULES.md + mdl -r ~MD013,~MD029,~MD033 README.md diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml new file mode 100644 index 0000000..64369e9 --- /dev/null +++ b/.github/workflows/test.yaml @@ -0,0 +1,35 @@ +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. +# This workflow will download a prebuilt Ruby version, install dependencies and run tests with Rake +# For more information see: https://github.com/marketplace/actions/setup-ruby-jruby-and-truffleruby + +name: Test + +on: + push: + branches: [ master ] + pull_request: + branches: [ master ] + +jobs: + test: + + runs-on: ubuntu-latest + + steps: + - uses: actions/checkout@v2 + - name: Set up Ruby + # To automatically get bug fixes and new Ruby versions for ruby/setup-ruby, + # change this to (see https://github.com/ruby/setup-ruby#versioning): + # uses: ruby/setup-ruby@v1 + uses: ruby/setup-ruby@v1 + with: + ruby-version: 2.6 + - name: Install dependencies + run: gem install awesome_bot + - name: Run tests + run: | + # Some URLs could be flaky, try twice in case the first execution fails. + bash run_awesome_bot.sh || bash run_awesome_bot.sh diff --git a/LICENSE b/LICENSE new file mode 100644 index 0000000..3bbbc1e --- /dev/null +++ b/LICENSE @@ -0,0 +1,116 @@ +CC0 1.0 Universal + +Statement of Purpose + +The laws of most jurisdictions throughout the world automatically confer +exclusive Copyright and Related Rights (defined below) upon the creator and +subsequent owner(s) (each and all, an "owner") of an original work of +authorship and/or a database (each, a "Work"). + +Certain owners wish to permanently relinquish those rights to a Work for the +purpose of contributing to a commons of creative, cultural and scientific +works ("Commons") that the public can reliably and without fear of later +claims of infringement build upon, modify, incorporate in other works, reuse +and redistribute as freely as possible in any form whatsoever and for any +purposes, including without limitation commercial purposes. These owners may +contribute to the Commons to promote the ideal of a free culture and the +further production of creative, cultural and scientific works, or to gain +reputation or greater distribution for their Work in part through the use and +efforts of others. + +For these and/or other purposes and motivations, and without any expectation +of additional consideration or compensation, the person associating CC0 with a +Work (the "Affirmer"), to the extent that he or she is an owner of Copyright +and Related Rights in the Work, voluntarily elects to apply CC0 to the Work +and publicly distribute the Work under its terms, with knowledge of his or her +Copyright and Related Rights in the Work and the meaning and intended legal +effect of CC0 on those rights. + +1. Copyright and Related Rights. A Work made available under CC0 may be +protected by copyright and related or neighboring rights ("Copyright and +Related Rights"). Copyright and Related Rights include, but are not limited +to, the following: + + i. the right to reproduce, adapt, distribute, perform, display, communicate, + and translate a Work; + + ii. moral rights retained by the original author(s) and/or performer(s); + + iii. publicity and privacy rights pertaining to a person's image or likeness + depicted in a Work; + + iv. rights protecting against unfair competition in regards to a Work, + subject to the limitations in paragraph 4(a), below; + + v. rights protecting the extraction, dissemination, use and reuse of data in + a Work; + + vi. database rights (such as those arising under Directive 96/9/EC of the + European Parliament and of the Council of 11 March 1996 on the legal + protection of databases, and under any national implementation thereof, + including any amended or successor version of such directive); and + + vii. other similar, equivalent or corresponding rights throughout the world + based on applicable law or treaty, and any national implementations thereof. + +2. Waiver. To the greatest extent permitted by, but not in contravention of, +applicable law, Affirmer hereby overtly, fully, permanently, irrevocably and +unconditionally waives, abandons, and surrenders all of Affirmer's Copyright +and Related Rights and associated claims and causes of action, whether now +known or unknown (including existing as well as future claims and causes of +action), in the Work (i) in all territories worldwide, (ii) for the maximum +duration provided by applicable law or treaty (including future time +extensions), (iii) in any current or future medium and for any number of +copies, and (iv) for any purpose whatsoever, including without limitation +commercial, advertising or promotional purposes (the "Waiver"). Affirmer makes +the Waiver for the benefit of each member of the public at large and to the +detriment of Affirmer's heirs and successors, fully intending that such Waiver +shall not be subject to revocation, rescission, cancellation, termination, or +any other legal or equitable action to disrupt the quiet enjoyment of the Work +by the public as contemplated by Affirmer's express Statement of Purpose. + +3. Public License Fallback. Should any part of the Waiver for any reason be +judged legally invalid or ineffective under applicable law, then the Waiver +shall be preserved to the maximum extent permitted taking into account +Affirmer's express Statement of Purpose. In addition, to the extent the Waiver +is so judged Affirmer hereby grants to each affected person a royalty-free, +non transferable, non sublicensable, non exclusive, irrevocable and +unconditional license to exercise Affirmer's Copyright and Related Rights in +the Work (i) in all territories worldwide, (ii) for the maximum duration +provided by applicable law or treaty (including future time extensions), (iii) +in any current or future medium and for any number of copies, and (iv) for any +purpose whatsoever, including without limitation commercial, advertising or +promotional purposes (the "License"). The License shall be deemed effective as +of the date CC0 was applied by Affirmer to the Work. Should any part of the +License for any reason be judged legally invalid or ineffective under +applicable law, such partial invalidity or ineffectiveness shall not +invalidate the remainder of the License, and in such case Affirmer hereby +affirms that he or she will not (i) exercise any of his or her remaining +Copyright and Related Rights in the Work or (ii) assert any associated claims +and causes of action with respect to the Work, in either case contrary to +Affirmer's express Statement of Purpose. + +4. Limitations and Disclaimers. + + a. No trademark or patent rights held by Affirmer are waived, abandoned, + surrendered, licensed or otherwise affected by this document. + + b. Affirmer offers the Work as-is and makes no representations or warranties + of any kind concerning the Work, express, implied, statutory or otherwise, + including without limitation warranties of title, merchantability, fitness + for a particular purpose, non infringement, or the absence of latent or + other defects, accuracy, or the present or absence of errors, whether or not + discoverable, all to the greatest extent permissible under applicable law. + + c. Affirmer disclaims responsibility for clearing rights of other persons + that may apply to the Work or any use thereof, including without limitation + any person's Copyright and Related Rights in the Work. Further, Affirmer + disclaims responsibility for obtaining any necessary consents, permissions + or other rights required for any use of the Work. + + d. Affirmer understands and acknowledges that Creative Commons is not a + party to this document and has no duty or obligation with respect to this + CC0 or use of the Work. + +For more information, please see + \ No newline at end of file diff --git a/Makefile b/Makefile new file mode 100644 index 0000000..9caf43a --- /dev/null +++ b/Makefile @@ -0,0 +1,6 @@ +lint: + mdl -r ~MD013,~MD029,~MD033 README.md + +test: + # Some URLs could be flaky, try twice in case the first execution fails. + bash run_awesome_bot.sh || bash run_awesome_bot.sh diff --git a/README.md b/README.md index e2abbdd..a8aaaa0 100644 --- a/README.md +++ b/README.md @@ -1,23 +1,48 @@ -OSX security related tools -==================== - -1. [OSX collector](https://github.com/Yelp/OSXCollector) - for forensic analysis -2. [MIDAS](https://github.com/etsy/MIDAS) - Mac Intrusion Detection Analysis System -3. [OSX auditor](https://github.com/jipegit/OSXAuditor) - for forensic analysis -4. [Santa](https://github.com/google/santa) - binary whitelisting/blacklisting system -5. [Masochist](https://github.com/squiffy/Masochist) - framework for creating XNU based rootkits -6. [Class-dump](http://stevenygard.com/projects/class-dump/) - command-line utility to dump Objective-C runtime information -7. [Mach inject](https://github.com/rentzsch/mach_inject) - Inter process code injection for Mac OS X -8. [Task vaccine](https://github.com/rodionovd/task_vaccine) - similar to mach inject -8. [Hopper](http://www.hopperapp.com/) - Hopper disassembler (not free) -9. [Mach-O diff](https://github.com/samdmarshall/machodiff) - mach-o diffing tool -10. [Mac4n6](https://github.com/pstirparo/mac4n6) - A collection of OS X and iOS forensic artifacts -11. [XGuardian scanner](https://github.com/openscanner/XGuardian) - Security Scanner for OSX -12. [Crashwalk](https://github.com/bnagy/crashwalk) -13. [PassiveFuzzFrameworks](https://github.com/SilverMoonSecurity/PassiveFuzzFrameworkOSX) - -iOS security related tools -==================== +# macOS and iOS Security Related Tools [![Awesome](https://awesome.re/badge-flat.svg)](https://awesome.re) ![Test](https://github.com/ashishb/osx-and-ios-security-awesome/workflows/Test/badge.svg) + +## Contents + +- [macOS Security](#macos-security) +- [iOS Security](#ios-security) +- [iOS Jailbreaks](#ios-jailbreaks) + +## macOS Security + +1. [OSX collector](https://github.com/Yelp/OSXCollector) - Forensic analysis. +2. [OSX auditor](https://github.com/jipegit/OSXAuditor) - Forensic analysis. +3. [mac_apt](https://github.com/ydkhatri/mac_apt) - macOS Artifact Parsing Tool for forensic analysis. +4. [MIDAS](https://github.com/etsy/MIDAS) - macOS Intrusion Detection Analysis System. +5. [Santa](https://github.com/google/santa) - Binary whitelisting/blacklisting system. +6. [Masochist](https://github.com/squiffy/Masochist) - Framework for creating XNU based rootkits. +7. [Class-dump](http://stevenygard.com/projects/class-dump/) - Command-line utility to dump Objective-C runtime information. +8. [Mach inject](https://github.com/rentzsch/mach_inject) - Inter process code injection for macOS. +9. [Task vaccine](https://github.com/rodionovd/task_vaccine) - Similar to mach inject. +10. [Hopper](http://www.hopperapp.com/) - Hopper disassembler (not free). +11. [Mach-O diff](https://github.com/samdmarshall/machodiff) - Mach-o diffing tool. +12. [Mac4n6](https://github.com/pstirparo/mac4n6) - A collection of macOS and iOS forensic artifacts. +13. [XGuardian scanner](https://github.com/openscanner/XGuardian) - Security Scanner for macOS. +14. [Crashwalk](https://github.com/bnagy/crashwalk) - Bucket and triage on-disk crashes +15. [PassiveFuzzFrameworks](https://github.com/SilverMoonSecurity/PassiveFuzzFrameworkOSX) +16. [osquery](https://github.com/facebook/osquery) - Cross-platform tool for data collection and forensic analysis. +17. [stronghold](https://github.com/alichtman/stronghold) - Easily configure macOS security settings from the terminal. +18. [BlockBlock](https://objective-see.com/products/blockblock.html) - BlockBlock continually monitors common persistence locations and displays an alert whenever a persistent component is added to the OS. +19. [Dylib Hijack Scanner](https://objective-see.com/products/dhs.html) - Simple utility that will scan your computer for applications that are either susceptible to dylib hijacking or have been hijacked. +20. [KextViewer](https://objective-see.com/products/kextviewr.html) - View all modules on that are loaded in the OS kernel. +21. [KnockKnock](https://objective-see.com/products/knockknock.html) - See what's persistently installed on your Mac. +22. [LinkLiar](http://halo.github.io/LinkLiar) - Link-Layer MAC spoofing GUI for macOS. +23. [LockDown](https://objective-see.com/products/lockdown.html) - Open-source tool for El Capitan that audits and remediates security configuration settings. +24. [MalwareBytes](https://www.malwarebytes.com/mac-download/) - Malwarebytes crushes the growing threat of Mac malware, so you are protected and your machine keeps running silky smooth. Cybersecurity smart enough for the Mac. +25. [OverSight](https://objective-see.com/products/oversight.html) - Monitor mic and webcam, alerting you when the internal mic is activated, or whenever a process accesses the webcam. +26. [RansomWhere?](https://objective-see.com/products/ransomwhere.html) - Ransomware Detection. +27. [TaskExplorer](https://objective-see.com/products/taskexplorer.html) - Explore all processes running on your Mac with TaskExplorer. +28. [What's Your Sign?](https://objective-see.com/products/whatsyoursign.html) - Adds menu item to Finder.app to display the cryptographic signing information for any file. +29. [FSMonitor](http://fsmonitor.com/) - Monitor all changes in the file system. +30. [Pareto Security](https://github.com/paretoSecurity/pareto-mac/) - A MenuBar app to automatically audit your Mac for basic security hygiene. +31. [Mana Security](https://github.com/manasecurity/mana-security-app) - Vulnerability Management app for individuals. It helps to keep macOS and installed applications updated. +32. [swiftGuard](https://github.com/Lennolium/swiftGuard) - Lightweight App that safeguards your System's USB Ports from any Unauthorized Access and performs various Counter-Measures. +33. [Pareto Security](https://paretosecurity.app/) - A MenuBar app to automatically audit your Mac for basic security hygiene. + +## iOS Security A collection of ios security related resources @@ -26,12 +51,23 @@ A collection of ios security related resources 3. [DVIA](http://damnvulnerableiosapp.com/) - Damn Vulnerable iOS App for learning 4. [LibiMobileDevice](https://github.com/libimobiledevice/libimobiledevice) - A cross-platform protocol library to communicate with iOS devices 5. [Needle](https://github.com/mwrlabs/needle) - iOS App Pentesting Tool -6. [NowSecure Lab Automated](https://www.nowsecure.com/blog/2016/09/19/announcing-nowsecure-lab-automated/) - Enterprise tool for mobile app security testing both iOS and Android mobile apps. Lab Automated features dynamic and static analysis on real devices in the cloud to return results in minutes. +6. [imobax](https://github.com/Siguza/imobax) - iOS Mobile Backup Extractor +7. [iMessage Fuzzing](https://github.com/googleprojectzero/iOS-messaging-tools) - iMessage fuzzing tools from Google's Project Zero +8. [Themis](https://github.com/cossacklabs/themis) - a multi-platform programming library for solving typical data security tasks: secure data storage, secure messaging, zero-knowledge proof authentication, etc. Recommended by OWASP MASVS. +9. [NowSecure Lab Automated](https://www.nowsecure.com/blog/2016/09/19/announcing-nowsecure-lab-automated/) - Enterprise tool for mobile app security testing both iOS and Android mobile apps. Lab Automated features dynamic and static analysis on real devices in the cloud to return results in minutes. +10. ~~[AppCritique](https://appcritique.boozallen.com) - iOS App Security Assessment Tool~~ +## iOS Jailbreaks + +1. [PhoenixPwn](https://phoenixpwn.com) - Jailbreak for 9.3.5 32-bit devices. + +### Other Awesome Lists -# Other Awesome Lists Other amazingly awesome lists can be found in the [awesome-awesomeness](https://github.com/bayandin/awesome-awesomeness) list. -# Contributing -Your contributions are always welcome! +--- + +## License + +Creative Commons License
This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License. diff --git a/contributing.md b/contributing.md new file mode 100644 index 0000000..6e8de68 --- /dev/null +++ b/contributing.md @@ -0,0 +1,15 @@ +# Contribution Guidelines + +Please ensure your pull request adheres to the following guidelines: + +- Search previous suggestions before making a new one, as yours may be a duplicate. +- Make sure your entries is useful before submitting. +- Make an individual pull request for each suggestion. +- Titles should be [capitalized](http://grammar.yourdictionary.com/capitalization/rules-for-capitalization-in-titles.html). +- Link additions should be added to the bottom of the relevant category. +- New categories or improvements to the existing categorization are welcome. +- Check your spelling and grammar. +- Make sure your text editor is set to remove trailing whitespace. +- The pull request and commit should have a useful title. + +Thank you for your suggestions! diff --git a/run_awesome_bot.sh b/run_awesome_bot.sh new file mode 100755 index 0000000..cf7fecc --- /dev/null +++ b/run_awesome_bot.sh @@ -0,0 +1,13 @@ +#!/usr/bin/env bash +set -euxo pipefail + +# objective-see.com gets 403 on CI. Probably due to some IP blacklist. +DEAD_URLS='objective-see.com','appcritique.boozallen.com' +SRC_FILE=README.md +awesome_bot \ + --allow-redirect \ + --allow-ssl \ + --allow-dupe \ + --skip-save-results \ + --white-list ${DEAD_URLS} \ + --files ${SRC_FILE}