OpenSec Atlas

grapefruit: An Open Source Tool for Application Security | OpenSec Atlas

Application Security

Tool

grapefruit

Grapefruit is a runtime application instrumentation tool for iOS that enables security automation and API security testing via Frida integration.

View on GitHub

About This Tool

(WIP) Runtime Application Instruments for iOS. Previously Passionfruit

Primary Use Case

This tool is primarily used by iOS security researchers and developers to instrument and analyze running iOS applications in real-time. It facilitates dynamic security testing and automation by injecting JavaScript code into apps over USB using Frida, helping uncover vulnerabilities and monitor API behavior.

Key Features

Runtime instrumentation of iOS applications using Frida
Security automation capabilities for dynamic analysis
API security testing and monitoring
Command-line interface for easy interaction
Web UI accessible at localhost for managing instrumentation
Integration with Node.js and npm for setup and usage
Open source with active community support via Discord
No authentication by default, emphasizing local usage

Insights & Recommendations

Grapefruit currently lacks authentication on its web UI, so it is strongly recommended to restrict access to localhost only to prevent unauthorized code injection. Users should ensure their system supports Frida's N-API requirements and follow troubleshooting guides if installation issues arise.

Installation

Install Node.js from https://nodejs.org/
Install Grapefruit CLI globally via npm: npm install -g igf
Set up Frida on your iOS device by adding the Frida repository in Cydia: https://build.frida.re
Install the Frida package on the iOS device via Cydia
Connect your iOS device via USB to enable Frida injection
Run the Grapefruit CLI using the 'igf' command

Usage

igf --help

Displays help information and available command options for the Grapefruit CLI

igf -h <hostname>

Specifies the hostname for the server side (default is 127.0.0.1)

igf -p <port>

Specifies the port number for the server side (default is 31337)

Smart Usage Notes

Leverage Grapefruit to automate dynamic API security testing during iOS app development cycles to catch vulnerabilities early.Use Grapefruit’s runtime instrumentation to simulate attacker behaviors in red team exercises targeting iOS applications.Integrate Grapefruit with CI/CD pipelines for continuous security validation of iOS apps before release.Combine Grapefruit with Frida scripts to develop custom detection signatures for blue team monitoring of suspicious app behaviors.Limit Grapefruit’s web UI access strictly to localhost and consider adding authentication to prevent unauthorized instrumentation.