2

There are many resources on Linux exploit development, but I cannot find any resources targeting macOS, except for some bad ones on YouTube.

Why are there no write-ups on macOS exploitation techniques, taking into account the Mach-O file format and the BSD-based kernel?

closed as primarily opinion-based by Polynomial, AndrolGenhald, Steffen Ullrich, schroeder Mar 16 at 9:08

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • I think your search terms might be off. When I search for "OSX exploit development" I get full-blown courses covering this topic... – schroeder Mar 15 at 14:57
  • Yes, paid courses. Can you find blogs or equivalent, like it is the case for Windows? – Shuzheng Mar 15 at 15:03
  • I suspect that the organizations who are doing professional OSX exploitation are not publishing their results or techniques. – Mike76 Mar 15 at 15:04
0

A new exploit for iOS/macOS discussed here — https://blog.zecops.com/vulnerabilities/analysis-and-reproduction-of-cve-2019-7286/

Here also is another older blog on macOS Mach-O targeting — https://www.offensive-security.com/vulndev/evocam-remote-buffer-overflow-on-osx/

  • Thank you - still the amount of resources is next to nothing compared to Windows/Linux material. – Shuzheng Mar 17 at 13:00
  • The resources are just in different places, under the auspice of Obj-C/Cocoa development instead of classic pen tester resources. Check out books like The Complete Friday Q&A or the newosxbook.com website and training. – atdre Mar 17 at 16:25
  • ahh, that explains things. If you know other canonical resources, please add them 🙂 – Shuzheng Mar 17 at 16:32

Not the answer you're looking for? Browse other questions tagged or ask your own question.