Git Product home page Git Product logo

mobilehacktools's Introduction

Mobile Security Toolchain

Build Status

This is the mobile security toolchain project. It is loosely based on the MSTG testing tools section (https://github.com/OWASP/owasp-mstg/blob/master/Document/0x08-Testing-Tools.md).

Current status

The project is in early beta stage. Feel free to contribute! Note that developments are currently slow as the primary focus is now on developing the MSTG. There are quiet a few bugs when running this on Catalina. We hope to resolve them in 2021 (as Corona outbreak made our work a little harder) unless a volunteer arrives earlier ;-).

Pre-requisites

Have a Mac OS X based system (needs 10.13.x) with about 4 GB of RAM and 4 GB of free space. Next, install Docker for Mac on it and then:

  • if you want to have both the iOS and Android tools, as well as all the scaffolding, just use ./install.sh

  • if you want to have the iOS tools only: install brew and Ansible, then type:

     ansible-galaxy install -r requirements.yml
      ansible-playbook -K ./iOS/generic_items.yml
  • if you want to have the Android tools only: install brew and Ansible, then type:

  ansible-playbook ./Android/generic_items.yml

Please note: the iOS part requires you to install XCode using the Mac App Store (MAS) which will ask you to authenticate with a popup.

Tools

Brew, pip and Ansible will be installed first, if not available. Then generic, iOS and Android tools will be installed:

Generic Tools

  • autoconf
  • bash-completion
  • dependency-check
  • doxygen
  • git
  • go
  • gpg
  • httpie
  • ideviceinstaller
  • libimobiledevice
  • mcrypt
  • mitmproxy
  • nmap
  • node
  • python #python 3
  • testssl.sh
  • openssl
  • wget
  • atom
  • burp-suite
  • chromedriver
  • docker
  • dropbox
  • firefox
  • google-chrome
  • java
  • owasp-zap
  • sequel-pro
  • vagrant
  • virtualbox
  • Frida
  • Radare2
  • Objection
  • MobSF
  • Appmon
  • zsh //sh -c "$(curl -fsSL https://raw.githubusercontent.com/robbyrussell/oh-my-zsh/master/tools/install.sh)"

Tools for Android

  • apktool
  • dependency-check
  • dex2jar
  • ideviceinstaller
  • jadx
  • libimobiledevice
  • mcrypt
  • node
  • android-studio
  • java
  • jd-gui
  • Nathan
  • super analyzer
  • Drozer
  • Qark

Tools for iOS

  • cmake
  • usbmuxd
  • libimobiledevice
  • qt@4
  • class-dump
  • itms
  • idb
  • java

Quirks

As we are still in development of 1.0, there are the following quirks:

  • Some applications might not work the first time as you will first have to start them from your Applications folder, such as: Android Studio (including ADB) & Docker for Mac. After that you have to run the runbooks once more. You should have , after 2 runs of the android runbook (e.g. run android runbook, run android studio, run android runbook, a working adb, given that you use .bash_profile)
  • iOS has not been tested on the buildserver (only general and android are, so please test them)
  • Some of the output of ansible seems very "drastic": in red/green/yellow. Please wait for it to finish and then see if something failed.
  • For iOS you need to run things twice: once to start the installation, while being logged in into the Apple store with your account (actual active state can be achieved by installing any app from the app-store), second time with an active developer account in xCode.
  • Lastly, it could be the case when you are testing this on a separate account, which does not have the correct rights for the brew folders. See Issue #30 reported by @TheDauntless. When you are on High Sierra you need to do:
  chgrp -R admin /usr/local/*
  chmod -R g+w /usr/local/*

and otherwise you can follow this fix.

Contribution

Does something not work? Create an issue, or even better: create a pull-request!

Special thanks to

@clviper (reviewing), @andreaslindeboom for a lot of ansible improvements, @meetinthemiddle-be for testing & @sushi2k for contributing & @hierynomus for fixing travis issues & @RiieCco for motivating me to get the project started. @geerlingguy for creating awesome Ansible roles that speeded up the development tremendously. Xebia, as a company from which I used an private repo to start hacking at the project. My wife for supporting me in doing mobile security open source projects in my spare time.

mobilehacktools's People

Contributors

andreaslindeboom avatar commjoen avatar meetinthemiddle-be avatar sushi2k avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

mobilehacktools's Issues

Avoid program name abbreviations for clarity

Examples:

Change DB to Dropbox

TASK [check if DB is installed] ************************************************
TASK [Install Dropbox] *********************************************************

Change SP to SequelPro

TASK [check if SP is installed] ************************************************
TASK [Install SP] **************************************************************

Prepare for open source

  • - create contribution guide (issue template + pr template)
  • - create better readme (intro, howto, contributing, thanks to @sushi2k , Xebians and @clviper)
  • - reassure proper thanks to Geerlingguy for awesome plugins
  • - reassure other licenses (and tell which items are currently installed)
  • - create automated build with checks
  • - note that this is still a Poc and can use a lot of help!
  • - have slack integration (done)
  • - Finish #2

The stdout is a bit dramatic about a package not being installed

Error below is shown in red from the second line onward. As this is default Ansible behaviour, please document in the readme that this is "normal".

TASK [check if FF is installed] ************************************************
fatal: [127.0.0.1]: FAILED! => {"changed": true, "cmd": "ls /Applications/Firefox.app", "delta": "0:00:00.008017", "end": "2018-09-06 04:04:53.078721", "msg": "non-zero return code", "rc": 1, "start": "2018-09-06 04:04:53.070704", "stderr": "ls: /Applications/Firefox.app: No such file or directory", "stderr_lines": ["ls: /Applications/Firefox.app: No such file or directory"], "stdout": "", "stdout_lines": []}
...ignoring

Link the project

We should have the project linked to the MSTG and other security bulletins. Next, let's see how we can share it!

adb doesn't work

Describe the bug
"adb" does not work, even after setting up Android Studio

To Reproduce
Steps to reproduce the behavior:

  1. Run the mobilehacktools installer (at least for android)
  2. open a terminal
  3. type adb

Expected behavior
the adb help page shows in terminal

Terminal output
-bash: adb: command not found

Desktop (please complete the following information):

  • OS: macOS

Additional context

Cleanup ansible

Need to cleanup ansible:

  • Make sure all is done with file, pip, homebrew and homebrew_cask module
  • Make sure that we use the binary_install_path on all custom installations (similar to classdump)
  • Make sure all that all is tested for idempotency in Travis

Install second list of tools

Let's make sure we install Adb, Angr, APK axtractor, Apkx, Burp Suite, Drozer, ClassDump(Z/etc), Clutch, Drozer, Frida, Hopper, Ghidra, IDB, Ipa Installer, iFunBox, iOS-deploy, KeychainDumper, Mobile-Security-Framework, Nathan, Needle, Objection, Magisk, PassionFruit, Radare 2, Tableplus, SOcket CAT, Xposed

Installer does not work on moljave

Describe the bug
The first step (the verification of the OS) does not work on a clean moljave installation

To Reproduce
Steps to reproduce the behavior:

  1. start clean moljave
  2. install docker for mac
  3. run install.sh
    Expected behavior
    A clear and concise description of what you expected to happen.

Terminal output
Platform check: OK. Proceeding with Mac OS X version check.
./install.sh: line 13: [[ProductName:: command not found
Detected incomaptible version of Mac OS X! Aborting installation. You need....

Desktop (please complete the following information):

  • Mac OS X 10.14.1

separate android and others, add basic, android and ios tooling

Assume installed (check if it is there, if not install it):

  • Virtualbox
  • Docker
  • python 2.7 & python 3
  • pip/pip3
  • Xcode
  • Android studio with an AVD

General:

  • MobSF (both docker container & local install)
  • ZAProxy
  • Burp
  • owasp dependency checker

Android:

  • dex2jar
  • apktool
  • jdgui & jadx
  • Drozer
  • Frida
  • Nathan

iOS:

  • Needle
  • Frida
  • Cycript
  • Objection
  • Needle
  • Appmon
  • class dump
  • Ida
  • idb

See section 0x08 of MSTG furthermore (let's improve that with more tools!!!)

install.sh fails when brew is installed by different user

Describe the bug
When running install.sh, the script fails early because of wrong permissions of brew.

To Reproduce

  1. Create new OS X user
  2. Install brew through user1
  3. Run install.sh from user2

Expected behavior
It works

Terminal output

/install.sh
Platform check: OK. Proceeding with Mac OS X version check.
Detected compatible version of Mac OS X! Proceeding with installation.
/usr/local/bin/brew
proceeding: brew installed
Installing Ansible
Error: No such keg: /usr/local/Cellar/ansible
Error: /usr/local/Cellar is not writable. You should change the
ownership and permissions of /usr/local/Cellar back to your
user account:
 sudo chown -R $(whoami) /usr/local/Cellar
Error: Cannot write to /usr/local/Cellar
Error: No such keg: /usr/local/Cellar/ansible
installing necessary roles

Desktop (please complete the following information):

  • OS: MacOS 10.13.6 (17G65)
  • Latest

Additional context
A fix is to create a group for brew and change the permissions (https://gitlab.com/alyda/dotfiles/snippets/19654). This would be outside of the scope of the install.sh script, but a sensible error message would be nice.

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.