mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-08-02 00:57:42 +03:00
Add folder anatomy (scripts/agent.py + references/api-reference.md) for 648 cybersecurity skills
Complete skill folder anatomy across all cybersecurity skills: - scripts/agent.py: 80-150 line Python agents using real libraries (impacket, boto3, azure-mgmt-*, kubernetes, pefile, yara, scapy, shodan, stix2, etc.) - references/api-reference.md: real API documentation with method signatures - LICENSE: MIT license for all skill folders
This commit is contained in:
mukul975
@@ -0,0 +1,21 @@
|
||||
MIT License
|
||||
|
||||
Copyright (c) 2025 Anthropic Agent Skills Contributors
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
of this software and associated documentation files (the "Software"), to deal
|
||||
in the Software without restriction, including without limitation the rights
|
||||
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||
copies of the Software, and to permit persons to whom the Software is
|
||||
furnished to do so, subject to the following conditions:
|
||||
|
||||
The above copyright notice and this permission notice shall be included in all
|
||||
copies or substantial portions of the Software.
|
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
||||
SOFTWARE.
|
||||
@@ -0,0 +1,105 @@
|
||||
# API Reference: iOS App Security with Objection
|
||||
|
||||
## Objection CLI
|
||||
|
||||
### Launch
|
||||
```bash
|
||||
objection -g com.example.app explore # Attach to running app
|
||||
objection -g com.example.app explore -s "command" # Run startup command
|
||||
objection patchipa --source app.ipa # Patch IPA with Frida gadget
|
||||
```
|
||||
|
||||
### Keychain & Data Storage
|
||||
```bash
|
||||
ios keychain dump # Dump keychain items
|
||||
ios keychain dump --json # JSON output
|
||||
ios cookies get # List HTTP cookies
|
||||
ios nsuserdefaults get # Read NSUserDefaults
|
||||
ios plist cat Info.plist # Read plist file
|
||||
```
|
||||
|
||||
### SSL Pinning
|
||||
```bash
|
||||
ios sslpinning disable # Bypass SSL pinning
|
||||
ios sslpinning disable --quiet # Quiet mode
|
||||
```
|
||||
|
||||
### Jailbreak Detection
|
||||
```bash
|
||||
ios jailbreak disable # Bypass jailbreak detection
|
||||
ios jailbreak simulate # Simulate jailbroken device
|
||||
```
|
||||
|
||||
### Hooking
|
||||
```bash
|
||||
ios hooking list classes # List all classes
|
||||
ios hooking list classes --include Auth # Filter classes
|
||||
ios hooking list class_methods ClassName # List methods
|
||||
ios hooking watch method "-[Class method]" # Watch method calls
|
||||
ios hooking set return_value "-[Class isJB]" false # Override return
|
||||
```
|
||||
|
||||
### Filesystem
|
||||
```bash
|
||||
ls / # List app sandbox root
|
||||
ls /Documents # List Documents directory
|
||||
file download /path/to/file local.out # Download file
|
||||
file upload local.file /remote/path # Upload file
|
||||
```
|
||||
|
||||
### Memory
|
||||
```bash
|
||||
memory dump all dump.bin # Dump all memory
|
||||
memory search "password" # Search memory for string
|
||||
memory list modules # List loaded modules
|
||||
memory list exports libModule.dylib # List module exports
|
||||
```
|
||||
|
||||
## Frida CLI
|
||||
|
||||
### Syntax
|
||||
```bash
|
||||
frida -U -n AppName # Attach by name
|
||||
frida -U -f com.app.id # Spawn and attach
|
||||
frida -U -n AppName -l script.js # Load script
|
||||
frida-ps -U # List running processes
|
||||
frida-ls-devices # List connected devices
|
||||
```
|
||||
|
||||
### Common Frida Scripts
|
||||
```javascript
|
||||
// Hook method and log arguments
|
||||
ObjC.choose(ObjC.classes.ClassName, {
|
||||
onMatch: function(instance) {
|
||||
Interceptor.attach(instance['- methodName:'].implementation, {
|
||||
onEnter: function(args) {
|
||||
console.log('arg1:', ObjC.Object(args[2]));
|
||||
}
|
||||
});
|
||||
}, onComplete: function() {}
|
||||
});
|
||||
```
|
||||
|
||||
## OWASP Mobile Top 10 (2024)
|
||||
|
||||
| ID | Category | Objection Check |
|
||||
|----|----------|-----------------|
|
||||
| M1 | Improper Credential Usage | `ios keychain dump` |
|
||||
| M2 | Inadequate Supply Chain Security | Binary analysis |
|
||||
| M3 | Insecure Authentication | Hook auth classes |
|
||||
| M4 | Insufficient Input/Output Validation | Hook input methods |
|
||||
| M5 | Insecure Communication | `ios sslpinning disable` |
|
||||
| M6 | Inadequate Privacy Controls | `ios nsuserdefaults get` |
|
||||
| M7 | Insufficient Binary Protections | Check PIE, ARC, stack canary |
|
||||
| M8 | Security Misconfiguration | `ios plist cat Info.plist` |
|
||||
| M9 | Insecure Data Storage | Filesystem + keychain review |
|
||||
| M10 | Insufficient Cryptography | Hook crypto classes |
|
||||
|
||||
## iOS App Sandbox Paths
|
||||
| Path | Contents |
|
||||
|------|----------|
|
||||
| `/Documents` | User-generated data |
|
||||
| `/Library/Caches` | Cached data |
|
||||
| `/Library/Preferences` | Plist settings |
|
||||
| `/tmp` | Temporary files |
|
||||
| `/Library/Cookies` | Cookie storage |
|
||||
@@ -0,0 +1,213 @@
|
||||
#!/usr/bin/env python3
|
||||
"""iOS app security analysis agent using Objection/Frida concepts.
|
||||
|
||||
Performs runtime security assessment of iOS apps including SSL pinning bypass,
|
||||
keychain dumping, filesystem inspection, and jailbreak detection bypass.
|
||||
"""
|
||||
|
||||
import subprocess
|
||||
import json
|
||||
import os
|
||||
import sys
|
||||
import re
|
||||
|
||||
|
||||
def run_objection(command, app_id=None, timeout=30):
|
||||
"""Execute an Objection command against a target app."""
|
||||
cmd = ["objection"]
|
||||
if app_id:
|
||||
cmd.extend(["-g", app_id])
|
||||
cmd.extend(["explore", "-c", command])
|
||||
try:
|
||||
result = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
|
||||
return result.stdout, result.returncode
|
||||
except FileNotFoundError:
|
||||
return "objection not installed (pip install objection)", 1
|
||||
except subprocess.TimeoutExpired:
|
||||
return "Command timed out", 1
|
||||
|
||||
|
||||
def run_frida(script_code, app_id, timeout=30):
|
||||
"""Execute a Frida script against target app."""
|
||||
cmd = ["frida", "-U", "-n", app_id, "-e", script_code]
|
||||
try:
|
||||
result = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
|
||||
return result.stdout, result.returncode
|
||||
except FileNotFoundError:
|
||||
return "frida not installed (pip install frida-tools)", 1
|
||||
except subprocess.TimeoutExpired:
|
||||
return "Command timed out", 1
|
||||
|
||||
|
||||
def dump_keychain(app_id):
|
||||
"""Dump keychain items accessible by the application."""
|
||||
return run_objection("ios keychain dump", app_id)
|
||||
|
||||
|
||||
def dump_cookies(app_id):
|
||||
"""Dump HTTP cookies stored by the application."""
|
||||
return run_objection("ios cookies get", app_id)
|
||||
|
||||
|
||||
def list_classes(app_id, filter_str=None):
|
||||
"""List Objective-C classes loaded in the app."""
|
||||
cmd = "ios hooking list classes"
|
||||
if filter_str:
|
||||
cmd += f" --include {filter_str}"
|
||||
return run_objection(cmd, app_id)
|
||||
|
||||
|
||||
def check_ssl_pinning(app_id):
|
||||
"""Check and bypass SSL certificate pinning."""
|
||||
return run_objection("ios sslpinning disable", app_id)
|
||||
|
||||
|
||||
def check_jailbreak_detection(app_id):
|
||||
"""Check for and bypass jailbreak detection."""
|
||||
return run_objection("ios jailbreak disable", app_id)
|
||||
|
||||
|
||||
def inspect_filesystem(app_id, path="/"):
|
||||
"""Inspect the application's filesystem sandbox."""
|
||||
return run_objection(f"ls {path}", app_id)
|
||||
|
||||
|
||||
def dump_plist(app_id):
|
||||
"""Dump application plist configuration files."""
|
||||
return run_objection("ios plist cat Info.plist", app_id)
|
||||
|
||||
|
||||
def check_pasteboard(app_id):
|
||||
"""Check pasteboard/clipboard for sensitive data."""
|
||||
return run_objection("ios pasteboard monitor", app_id)
|
||||
|
||||
|
||||
def search_binary_strings(app_id, pattern):
|
||||
"""Search for strings in the app binary."""
|
||||
return run_objection(f"memory search '{pattern}'", app_id)
|
||||
|
||||
|
||||
OWASP_MOBILE_CHECKS = {
|
||||
"M1_Improper_Platform_Usage": {
|
||||
"checks": ["ios keychain dump", "ios plist cat Info.plist"],
|
||||
"description": "Check for misuse of platform security features",
|
||||
},
|
||||
"M2_Insecure_Data_Storage": {
|
||||
"checks": ["ios keychain dump", "ios cookies get", "ios nsuserdefaults get"],
|
||||
"description": "Check for sensitive data in insecure storage",
|
||||
},
|
||||
"M3_Insecure_Communication": {
|
||||
"checks": ["ios sslpinning disable"],
|
||||
"description": "Test SSL/TLS implementation and certificate pinning",
|
||||
},
|
||||
"M4_Insecure_Authentication": {
|
||||
"checks": ["ios hooking list classes --include Auth",
|
||||
"ios hooking list classes --include Login"],
|
||||
"description": "Analyze authentication mechanisms",
|
||||
},
|
||||
"M5_Insufficient_Cryptography": {
|
||||
"checks": ["ios hooking list classes --include Crypto",
|
||||
"ios hooking list classes --include AES"],
|
||||
"description": "Review cryptographic implementations",
|
||||
},
|
||||
"M8_Code_Tampering": {
|
||||
"checks": ["ios jailbreak disable"],
|
||||
"description": "Test runtime integrity and jailbreak detection",
|
||||
},
|
||||
"M9_Reverse_Engineering": {
|
||||
"checks": ["ios hooking list classes"],
|
||||
"description": "Assess reverse engineering protections",
|
||||
},
|
||||
}
|
||||
|
||||
|
||||
def run_owasp_assessment(app_id):
|
||||
"""Run OWASP Mobile Top 10 security checks."""
|
||||
results = {}
|
||||
for category, config in OWASP_MOBILE_CHECKS.items():
|
||||
category_results = {"description": config["description"], "findings": []}
|
||||
for check in config["checks"]:
|
||||
output, rc = run_objection(check, app_id)
|
||||
category_results["findings"].append({
|
||||
"command": check,
|
||||
"status": "success" if rc == 0 else "failed",
|
||||
"output_preview": output[:200] if output else "",
|
||||
})
|
||||
results[category] = category_results
|
||||
return results
|
||||
|
||||
|
||||
FRIDA_SCRIPTS = {
|
||||
"ssl_pinning_bypass": """
|
||||
ObjC.choose(ObjC.classes.NSURLSessionConfiguration, {
|
||||
onMatch: function(instance) {
|
||||
instance['- setTLSMinimumSupportedProtocol:'](0);
|
||||
}, onComplete: function() {}
|
||||
});
|
||||
""",
|
||||
"jailbreak_bypass": """
|
||||
var paths = ['/Applications/Cydia.app', '/usr/sbin/sshd', '/etc/apt'];
|
||||
Interceptor.attach(ObjC.classes.NSFileManager['- fileExistsAtPath:'].implementation, {
|
||||
onEnter: function(args) { this.path = ObjC.Object(args[2]).toString(); },
|
||||
onLeave: function(retval) {
|
||||
if (paths.some(p => this.path.includes(p))) retval.replace(0);
|
||||
}
|
||||
});
|
||||
""",
|
||||
"keychain_dump": """
|
||||
var kSecClass = ObjC.classes.__NSDictionary.dictionaryWithObject_forKey_(
|
||||
ObjC.classes.__NSCFConstantString.alloc().initWithUTF8String_('genp'),
|
||||
ObjC.classes.__NSCFConstantString.alloc().initWithUTF8String_('class')
|
||||
);
|
||||
console.log('Keychain query prepared');
|
||||
""",
|
||||
}
|
||||
|
||||
|
||||
def generate_report(app_id, assessment_results):
|
||||
"""Generate iOS security assessment report."""
|
||||
findings_count = sum(
|
||||
len(cat["findings"]) for cat in assessment_results.values()
|
||||
)
|
||||
return {
|
||||
"app_identifier": app_id,
|
||||
"assessment_framework": "OWASP Mobile Top 10",
|
||||
"categories_tested": len(assessment_results),
|
||||
"total_checks": findings_count,
|
||||
"results": assessment_results,
|
||||
}
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
print("=" * 60)
|
||||
print("iOS App Security Analysis Agent (Objection/Frida)")
|
||||
print("Runtime analysis, SSL bypass, keychain dump, OWASP checks")
|
||||
print("=" * 60)
|
||||
|
||||
app_id = sys.argv[1] if len(sys.argv) > 1 else None
|
||||
|
||||
if not app_id:
|
||||
print("\n[DEMO] Usage: python agent.py <app_bundle_id>")
|
||||
print(" e.g. python agent.py com.example.app")
|
||||
print("\nAvailable checks:")
|
||||
for category, config in OWASP_MOBILE_CHECKS.items():
|
||||
print(f" {category}: {config['description']}")
|
||||
print("\nFrida scripts available:")
|
||||
for name in FRIDA_SCRIPTS:
|
||||
print(f" {name}")
|
||||
sys.exit(0)
|
||||
|
||||
print(f"\n[*] Target: {app_id}")
|
||||
print("[*] Running OWASP Mobile Top 10 assessment...")
|
||||
|
||||
results = run_owasp_assessment(app_id)
|
||||
report = generate_report(app_id, results)
|
||||
|
||||
for category, data in results.items():
|
||||
status_counts = {"success": 0, "failed": 0}
|
||||
for f in data["findings"]:
|
||||
status_counts[f["status"]] += 1
|
||||
print(f"\n [{category}] {data['description']}")
|
||||
print(f" Checks: {status_counts['success']} passed, {status_counts['failed']} failed")
|
||||
|
||||
print(f"\n{json.dumps(report, indent=2, default=str)}")
|
||||
Reference in New Issue
Block a user