Offensive MacOS

This is a collection of macOS specific tooling, blogs, and other related information for offensive macOS assessments.

If you find something that's not on here, open an issue or a merge request and we can get it added.

Tools

https://github.com/cedowens/SwiftBelt
- Swift tool for doing safety checks on a macOS host for red teaming
https://github.com/xorrior/xpcutil
- Tool for sending XPC messages to launchd
https://github.com/Tyilo/insert_dylib
- Tool for injecting dylib weak/strong headers into a Mach-O binary
https://github.com/its-a-feature/bifrost
- Tool for interacting with Kerberos on macOS

https://github.com/cedowens/Mythic-Macro-Generator
- tool to generate Microsoft Office Macros for running Mythic's apfell payload
https://github.com/cedowens/macOS-browserhist-parser
- tool for parsing macOS browser history on disk
https://github.com/xorrior/macOSTools
- repo of a lot of macOS tooling
https://github.com/its-a-feature/macos_execute_from_memory
- starter code to run macos code from memory
https://github.com/herrbischoff/awesome-macos-command-line
- Lots of commandline based actions that aren't necessarily offensive, but can be pretty handy
http://newosxbook.com/ent.jl
- Web resource of entitlements for macOS binaries
https://github.com/ahhh/macOS_profiles
- Collection of macOS configuration profiles for penetration testing and red teaming