MASTG-Hacking-Playground

MASTG Hacking Playground Welcome to the MASTG Hacking Playground which is part of the OWASP Mobile Application Security MAS project. The MASTG Hacking Playground is a collection of educational iOS and Android mobile apps, that are intentionally build insecure in order to give practical guidance t...

used_sock

usedsock Kernel exploit for iOS 12-12.2 and 12.4. This isn't meant to be used in a jailbreak. You can find the writeup here...

house

root@kitploit: / | \ / / | | / // \ \ Y | /\ \ / | / /|// \ / House / / Dynamic Mobile Analysis Tool Contact: [email protected] House : A runtime mobile application analysis toolkit with a Web GUI, powered by Frida, written in Python. It is designed for helping assess mobile...

Dwarf

Dwarf A debugger for reverse engineers, crackers and security analyst. Or you can call it damn, why are raspberries so fluffy or yet, duck warriors are rich as fuck. Whatever you like! Built on top of pyqt5, frida and some terrible code. Known Issues JavaTraceView is distorted JavaTraceView shows...

objection

📱objection - 运行时移动探索工具 objection 是一个运行时移动探索工具包，基于 Frida，旨在帮助你评估移动应用的安全状况，无需越狱。 支持 iOS 和 Android。 检查并交互容器文件系统。 绕过 SSL 证书固定。 导出钥匙串。 执行内存相关任务，例如转储与修补。 探索并操作堆上的对象。 还有更多更多功能... 截图可在wiki中查看。 安装 安装非常简单，只需执行 pip3 install objection。这将为你提供 objection 命令。你可以通过 pip3 install --upgrade objection 更新现有的 objection...

CVE-2026-65330

CVE-2026-65330 — tmpfs setxattr PAC Bypass Component: XNU VFS — defaultsetxattrdoubleagent tmpfs VNOP Affected: iOS / iPadOS 26.6 23G71 and earlier Fixed in: iOS / iPadOS 26.6.1 23G83 Type: Fixed PAC diversifier in xattr handler pointer signing Impact: PC control from kernel context; full privile...

CVE-2026-65343

CVE-2026-65343 — AppleKeyStore OOB Read KASLR Defeat Component: AppleKeyStore kernel extension — LibSerSEPControlDeserialize Affected: iOS / iPadOS 26.6 23G71 and earlier Fixed in: iOS / iPadOS 26.6.1 23G83 Type: Out-of-Bounds read in SEP control message deserialization Impact: Kernel pointer lea...

CVE-2025-31200

CVE-2025-31200: CoreAudio APAC Channel Remapping Buffer Overflow Vulnerability Overview CVE-2025-31200 is a buffer overflow vulnerability in Apple's CoreAudio framework affecting the Apple Positional Audio Codec APAC decoder. The bug exists in the APACChannelRemapper::Process function within...

CVE-2018-4407

CVE-2018-4407 CVE-2018-4407 is a buffer overflow vulnerability in the XNU kernel's ICMP error code. It causes IOS devices to crash both laptops and mobiles upon receival of one yes 1! single bad packet. The bug was originally disclosured by Kevin Backhouse on his lgtm blogpost on October 30th 201...

CVE-2023-20198

CVE 2023-20198 Introduction The web UI component of Cisco IOS XE Software has a previously undiscovered vulnerability that, when exposed to the internet or untrusted networks, is already being actively exploited, according to Cisco. Due to this vulnerability, a remote, unauthenticated attacker is...

truegaze

truegaze Android および iOS アプリケーション向けの静的解析ツールで、ソースコード以外のリソース文字列、サードパーティライブラリ、設定ファイルなどのセキュリティ問題に焦点を当てています。 要件 Python 3 が必要です。必要なモジュールは全て requirements.txt ファイルに記載されています。 Python 3.7 でのみテスト済みですが、他の 3.x リリースでも動作するはずです。現時点では 2.x のサポートは予定していません。 インストール 以下のように PIP でインストールできます。 root@kitploit: pip install...

CVE-2026-20687-AppleJPEGDriver-UAF

CVE-2026-20687 — AppleJPEGDriver startDecoder Timeout UAF CVE-2026-20687 · Enfilade · enfilade.io Component: Kernel Impact: An app may be able to cause unexpected system termination or write kernel memory. Description: A use after free issue was addressed with improved memory management. —Apple...

PoC

PoC A collection of proof-of-concept codes from DARKNAVY. CVE-2025-43300 Target: iOS && macOS Version: before iOS 18.6.2 && macOS 14.7.8 CVE-2025-6554 Target: Chrome Renderer Version: before 138.0.7204.96 CVE-2024-5274 Target: Chrome Renderer Version: before 125.0.6422.112 Blog Post: CVE-2024-527...

Signal-Desktop

Signal Desktop Signal Desktop links with Signal on Android or iOS and lets you message from your Windows, macOS, and Linux computers. Install the production version or help us out by installing the beta version. Got a question? You can find answers to a number of frequently asked questions on our...

ish

iSH iSHは、ユーザーモードのx86エミュレーションとシステムコールの翻訳を使用して、iOS上でLinuxシェルを実行するプロジェクトです。 プロジェクトの現状については、issueタブとコミットログを確認してください。 App Storeページ TestFlightベータ Discordサーバー ヘルプとチュートリアルのWiki ハッキング このプロジェクトにはgitサブモジュールがあります。--recurse-submodulesを使用してクローンするか、クローン後にgit submodule update --initを実行してください。...

ish

iSH A project to get a Linux shell running on iOS, using usermode x86 emulation and syscall translation. For the current status of the project, check the issues tab, and the commit logs. App Store page TestFlight beta Discord server Wiki with help and tutorials README中文 如若未能保持最新，请提交PR以更新 Hacking...

xpc-string-leak

xpc-string-leak xpc-string-leak is a proof-of-concept exploit for an out-of-bounds memory read in libxpc. This exploit uses the vulnerability to read out-of-bounds heap memory from diagnosticd, an unsandboxed root process with the taskforpid-allow entitlement. The vulnerability: CVE-2018-4248 On...

CiscoIOSSNMPToolkit

CiscoIOSSNMPToolkit Cisco iOS SNMP Overflow Exploit Toolkit CVE-2017-6736...

isslfix

iOS : iSSLFix: Certificate in chain starting at has isCA=0 = possible MITM attempt, making valida...

TWSL2011-007_iOS_code_workaround

= testcert Reference implementation for TWSL2011-007 vulnerability workaround aka CVE-2011-0228. Author: Eric Monti Date: July 28, 2011 = Compiling Compile with your Apple iOS SDK CFLAGS along with: gcc -o testcert testcert.m -framework Foundation -framework Security The compile arguments above...