Carcará

Carcará is a powerful CLI written in Python and designed to elegantly and simply orchestrate the complete workflow of dynamic analysis, penetration testing, and reverse engineering in mobile applications.

Instead of memorizing device information with jailbreaking and repetitive file transfer or SSH connection commands, do what really matters when it comes to AppSec: find vulnerabilities as quickly as possible.

Carcará aims to help Mobile AppSec professionals become more efficient by combining several cutting-edge tools into a single CLI and managing the environment in an isolated and resilient way. Forget about memorizing IPs of various devices: start memorizing processes, not commands.

Features

  1. Isolated environment: Carcará has its own environment for installing tools written in Python or Node.js. Therefore, every time you use it, you can be sure you are using the most stable version, allowing you to explore other versions if you wish, without compromising your production environment.

  2. Device Management: Register your jailbroken device once, and use it whenever necessary. Multiple devices are allowed, but only the active one will connect to the tools.

  3. Recognized Tools: Frida, Frida-ps, Objection, iproxy are some of the tools included in Carcará, without the need to install them one by one: install Carcará, run carcara tools install and everything will be installed in the isolated environment, ready to use.

  4. Practical Injection and Bypass via Frida: Script injection at spawn or attach, plus direct support for Frida CodeShare scripts and SSL Pinning bypass automation.

  5. IPA Extraction and Dumping: Module to extract and decrypt .ipa files directly from the device to your machine with a single carcara frida dump command.

  6. Artifact Extraction: Automated transfer via SCP to pull database, Keychain dumps, NSUserDefaults, and cookies directly to your local evidence folder.

Apexbench

Perform benchmarks simply, quickly, and surgically: define the data input and wait for a report in .md ready to be published.

Following a reproducible approach, run comparative tests of local tools or LLMs using only one configuration file. Extract the metrics you need with the flexibility of jq.

Features

  1. Everything in a single file: In a .yaml, define steps, variants, and parameters with the number of iterations and warmups required.

  2. Precise metric collection: Extract customized data from the tool output using jq, in addition to automatic measurement of CPU usage, execution time, and peak memory.

  3. Markdown Output (SSG-Native): Upon completion of tests, obtain a structured Markdown report ready to be published on your static site generator (such as Hugo).

  4. Methodology with Warmup: Native support for warmup rounds (warmup) disregarded from statistics, eliminating distortions caused by operating system caching, JIT compilation, or initial loading of models on the GPU/VRAM.

  5. Agnostic and CLI-Oriented: The command field accepts generic shell templates with support for placeholders ({input}, {output}, {config}). Any tool with a terminal interface can be evaluated.

  6. Re-rendering without Re-execution: Saves the raw data from each execution in JSON (results/raw/), allowing you to regenerate or update the Markdown report at any time without having to run lengthy tests again.

Zub

Intuitive web interface developed to optimize the routine of developers and engineering teams.

The ideal companion for the individual developer and a productivity facilitator for technology teams.

Features

  1. Cost Calculator: Enter the technology stack, RPS (requests per second) metrics, client volume, and backup requirements to obtain a clear cost estimate for your project.

  2. Headers & AppSec Audit: Scan web applications for common misconfigurations in security headers and obtain a detailed score on the level of protection of the environment.

  3. Scrum & Planning Suite: Have essential agile methodology utilities at hand (such as Planning Poker and estimations) to efficiently conduct sprint refinements and planning.

  4. History & Traceability: Automatic logging of executions and queries to ensure tracking of metrics and audits without losing history.