check_icmp_dos

checkicmpdos iOS 12 / OS X Remote Kernel Heap Overflow CVE-2018-4407 POC: root@kitploit: pip install scapy sudo scapy sendIPdst=“Target IP“,options=IPOption“A”8/TCPdport=2323,options=19, “1"18,19, “2”18 Or use the script root@kitploit: python checkicmpdos.py 127.0.0.1 This vulnerability allows an...

CVE-2022-42864

CVE-2022-42864: Diabolical Cookies What is this repo? This is my incomplete proof-of-concept exploit for CVE-2022-42864, a time-of-check-time-of-use vulnerability in IOHIDFamily that was fixed in iOS 16.2 / macOS Ventura 13.1. What is the status of the proof-of-concept? The exploit currently...

DockTransparent

DockTransparent iOS 14 - 16.1.2 Reboot your device to revert the changes. iOS14❌ Install TrollStore AltStore Credits https://github.com/zhuowei MacDirtyCow exploit https://twitter.com/straighttamago DockTransparent...

blanket

blanket Blanket は iOS 11.2.6 を標的としたサンドボックス脱出ツールであり、主要な脆弱性は iOS 11.4.1 でのみ修正されました。このツールは launchd の Mach ポート置換の脆弱性 CVE-2018-4280 と、その他のサービスにおけるいくつかの小さな脆弱性を悪用し、サンドボックス化されておらず、root で動作し、taskforpid-allow エンタイトルメントを持つ ReportCrash プロセス内でコードを実行します。これにより、Blanket は amfid...

awesome-ios-security

Awesome iOS Security A curated list of awesome iOS application security resources. A collection of awesome tools, books, courses, blog posts, and cool stuff about iOS Application Security and Penetration Testing. Contents Tools Reverse Engineering Tools Static Analysis Tools Dynamic Analysis Tool...

frida-ios-dump

frida-ios-dump Pull a decrypted IPA from a jailbroken device Usage 1. Install frida on device 2. sudo pip install -r requirements.txt --upgrade 3. Run usbmuxd/iproxy SSH forwarding over USB Default 2222 - 22. e.g. iproxy 2222 22 4. Run ./dump.py Display name or Bundle identifier For SSH/SCP make...

CVE-2022-32832

CVE-2022-32832 Proof-of-concept and write-up for the CVE-2022-32832 vulnerability patched in iOS 15.6 CVE-2022-32832 is a vulnerability in the AppleAPFSUserClient::methodDeltaCreateFinalize external method selector 49. Here is the decompilation pre-patch: root@kitploit: int64 cdecl...

extra_recipe-iOS-10.2

extrarecipe-iOS-10.2 CVE-2017-2370 代码与利用工具由 ianbeer https://bugs.chromium.org/p/project-zero/issues/detail?id=1004 已修复 https://support.apple.com/en-us/HT207482...

CVE-2023-20198-IOS-XE-Scanner

CVE-2023-20198-IOS-XE-Scanner Single threaded scanner for a single IP in PowerShell Very quick and dirty PoC to show the concept. Tested in lab. Use at own risk! Other scanners python https://github.com/fox-it/cisco-ios-xe-implant-detection https://github.com/Shadow0ps/CVE-2023-20198-Scanner...

Clutch

Clutch Clutch is a high-speed iOS decryption tool. Clutch supports the iPhone, iPod Touch, and iPad as well as all iOS version, architecture types, and most binaries. Clutch is meant only for educational purposes and security research. Clutch requires a jailbroken iOS device with version 8.0 or...

ssl-kill-switch2

SSL Kill Switch 2 Blackbox tool to disable SSL/TLS certificate validation - including certificate pinning - within iOS and macOS applications. Second iteration of https://github.com/iSECPartners/ios-ssl-kill-switch . Description Once loaded into an iOS or macOS application, SSL Kill Switch 2 will...

ssl-kill-switch2

SSL Kill Switch 2 ブラックボックスツール。iOSおよびmacOSアプリケーション内でSSL/TLS証明書検証（証明書ピンニングを含む）を無効化します。https://github.com/iSECPartners/ios-ssl-kill-switch の第2版です。 説明 iOSまたはmacOSアプリケーションに読み込まれると、SSL Kill Switch 2はSSL/TLS接続の処理を担当する低レベル関数にパッチを適用し、システムのデフォルトの証明書検証に加えて、あらゆる種類のカスタム証明書検証（証明書ピンニングなど）を上書きして無効化します。 Apple App...

frida-ios-dump-modern

Modern iOS IPA Dumper A modern iOS application memory decryption tool built for Frida 17.5.2+ with full support for iOS 14-16 and multiple jailbreaks. Status: ✅ Working and Tested - Successfully dumps and decrypts iOS apps using Frida 17.5.2 on: iOS 14.7.1 + Taurine jailbreak iPad mini 5 iOS...

DarkSword_analysis

DarkSwordanalysis Static analysis of the DarkSword iOS WebKit exploit chain — delivery, staging, and CVE breakdown CVE-2025-31277, CVE-2025-43529 I'm a freshman Information Systems student working through this exploit chain as I build my reverse engineering and malware analysis skills. I'll updat...

CVE-2022-32832

CVE-2022-32832 Proof-of-concept and write-up for the CVE-2022-32832 vulnerability patched in iOS 15.6 CVE-2022-32832 is a vulnerability in the AppleAPFSUserClient::methodDeltaCreateFinalize external method selector 49. Here is the decompilation pre-patch: root@kitploit: int64 cdecl...

ida_kcpp

idakcpp An IDAPython module for way more convienent way to Reverse Engineering iOS kernelcaches. Big part of the iOS kernelcache is written by C++, which compiled into complicated binary code use many virtual table derefences rather than explicit direct calls.idakcpp takes the advanteage of...

CVE-2025-14174-analysis

CVE-2025-14174 分析: ANGLE Metal ステージングバッファの範囲外書き込み CVE-2025-14174 の技術分析と概念実証 | ---|--- CVE| CVE-2025-14174 重大度| 高 実地での悪用| あり - iOS 26 未満への標的型攻撃 影響を受ける製品| iOS Safari、macOS Chrome/Chromium/Electron（macOS Safari を除く） ステータス| ANGLE コミット 95a32cb で修正済み クレジット| Apple、Google Threat Analysis Group 実地での悪用 App...

qub-network-security-cve-2023-20198

🛡️ qub-network-security-cve-2023-20198 Analysis, detection, and mitigation of CVE-2023-20198 exploitation in Cisco IOS XE 📘 Queen’s University Belfast – CSC3064 Network Security Assessment 📋 Assessment Overview This project involves analyzing PCAP files provided by Fox-IT to: Identify Indicators o...

CVE-2025

CVE-2025-43300: iOS/macOS DNG Image Processing Memory Corruption Overview CVE-2025-43300 is a critical memory corruption vulnerability in Apple's image processing framework that affects iOS 18.6.1 and macOS systems. The vulnerability exists in the JPEG Lossless decompression code within...

cve-2025-5915

CVE-2025-5915 — libarchive RAR v4 heap over-read with on-device iOS 18.5 proof A controlled heap over-read / memory-disclosure in libarchive's RAR v4 filter path copyfromlzsswindow. This repo reproduces it end to end: local ASan, a from-scratch RAR v4 encoder that dials the leak size, and an...