Pros of TrustKit

• Provides a comprehensive SSL pinning solution for iOS and macOS applications
• Offers additional features like reporting and pinning configuration options
• Actively maintained with regular updates and community support

Cons of TrustKit

• More complex implementation compared to ssl-kill-switch2
• Requires integration into the application code, which may not be suitable for all use cases
• Potentially higher performance overhead due to additional features

Code Comparison

TrustKit implementation:

let trustKitConfig = [
    kTSKSwizzleNetworkDelegates: false,
    kTSKPinnedDomains: [
        "example.com": [
            kTSKPublicKeyAlgorithms: [kTSKAlgorithmRsa2048],
            kTSKPublicKeyHashes: [
                "HXXQgxueCIU5TTLHob/bPbwcKOKw6DkfsTWYHbxbqTY=",
                "0SDf3cRToyZJaMsoS17oF72VMavLxj/N7WBNasNuiR8="
            ]
        ]
    ]
]
TrustKit.initSharedInstance(withConfiguration: trustKitConfig)

ssl-kill-switch2 implementation:

#import "SSLKillSwitch.h"

- (void)viewDidLoad {
    [super viewDidLoad];
    [SSLKillSwitch enableSSLKillSwitch];
}

The code comparison shows that TrustKit requires more configuration and integration into the application, while ssl-kill-switch2 offers a simpler, one-line implementation for disabling SSL certificate validation.

Pros of Mobile-Security-Framework-MobSF

• Comprehensive mobile app security assessment tool for both Android and iOS
• Provides static and dynamic analysis, along with web API testing capabilities
• Active development with frequent updates and a large community

Cons of Mobile-Security-Framework-MobSF

• More complex setup and usage compared to ssl-kill-switch2
• Requires more system resources due to its extensive features
• May have a steeper learning curve for beginners

Code Comparison

ssl-kill-switch2 (Objective-C):

static void (*original_SSLSetSessionOption)(SSLContextRef context, SSLSessionOption option, Boolean value);
static void replaced_SSLSetSessionOption(SSLContextRef context, SSLSessionOption option, Boolean value) {
    // Disable certificate validation
    if (option == kSSLSessionOptionBreakOnServerAuth) {
        value = true;
    }
    original_SSLSetSessionOption(context, option, value);
}

Mobile-Security-Framework-MobSF (Python):

def apk_analysis(app_dir, tool_dir, app_path, manifest_file):
    """Perform APK Analysis."""
    try:
        logger.info('APK Analysis Started')
        qark = os.path.join(tool_dir, 'qark', 'qark', 'qark.py')
        args = [
            'python3', qark,
            '--java', app_dir,
            '--apk', app_path,
            '-m', manifest_file,
            '-a', app_dir,
            '-r', os.path.join(app_dir, 'qark'),
        ]
        subprocess.call(args)
        logger.info('APK Analysis Completed')
    except Exception:
        logger.exception('APK Analysis')

Pros of owasp-mastg

• Comprehensive mobile app security testing guide covering both Android and iOS
• Regularly updated with community contributions and industry best practices
• Includes detailed testing procedures, code examples, and security recommendations

Cons of owasp-mastg

• Larger project scope, which may be overwhelming for specific SSL/TLS testing needs
• Requires more time to navigate and find relevant information for SSL/TLS bypassing
• Not focused solely on SSL/TLS certificate pinning bypass techniques

Code Comparison

ssl-kill-switch2:

%hook NSURLSessionTask
- (void)resume {
    %orig;
    [SSLKillSwitch swizzleNSURLSessionTaskResume:self];
}
%end

owasp-mastg:

@Override
public void checkServerTrusted(X509Certificate[] chain, String authType)
        throws CertificateException {
    try {
        TrustManagerFactory tmf = TrustManagerFactory.getInstance("X509");
        tmf.init((KeyStore) null);
        for (TrustManager tm : tmf.getTrustManagers()) {
            ((X509TrustManager) tm).checkServerTrusted(chain, authType);
        }
    } catch (Exception e) {
        throw new CertificateException(e);
    }
}

The ssl-kill-switch2 code focuses on swizzling NSURLSessionTask for SSL pinning bypass, while the owasp-mastg example demonstrates a more general approach to custom certificate validation in Android.

Pros of nogotofail

• Broader scope: Focuses on network security testing beyond just SSL/TLS
• Cross-platform support: Works on various operating systems and devices
• Active development: More recent updates and contributions

Cons of nogotofail

• More complex setup: Requires additional components and configuration
• Steeper learning curve: Less straightforward for beginners
• Not specifically tailored for iOS SSL/TLS manipulation

Code Comparison

ssl-kill-switch2 (Objective-C):

%hook NSURLSessionTask
- (void)resume {
    if (shouldHookNSURLSessionTask()) {
        [self setValue:[NSNumber numberWithBool:YES] forKey:@"_kCFStreamPropertySSLPeerCertificatesEnabled"];
    }
    %orig;
}
%end

nogotofail (Python):

def on_ssl(self, client_hello):
    if self.mitm_params.get("strip_heartbleed"):
        return client_hello.modify(
            extensions=client_hello.extensions.filter(
                lambda x: x.type != 15
            )
        )
    return client_hello

The code snippets demonstrate the different approaches: ssl-kill-switch2 focuses on iOS-specific SSL/TLS manipulation, while nogotofail provides a more general network security testing framework.

Pros of Frida

• More versatile and powerful, supporting dynamic instrumentation across multiple platforms and languages
• Actively maintained with frequent updates and a large community
• Offers a rich API for complex runtime manipulation and analysis

Cons of Frida

• Steeper learning curve due to its extensive features and capabilities
• Requires more setup and configuration for specific use cases
• May have a larger performance overhead for simple tasks

Code Comparison

SSL-Kill-Switch2 (Objective-C):

static void (*original_SSLSetSessionOption)(SSLContextRef context, SSLSessionOption option, Boolean value);
static void replaced_SSLSetSessionOption(SSLContextRef context, SSLSessionOption option, Boolean value) {
    if (option == kSSLSessionOptionBreakOnServerAuth) {
        value = true;
    }
    original_SSLSetSessionOption(context, option, value);
}

Frida (JavaScript):

Interceptor.attach(Module.findExportByName(null, 'SSLSetSessionOption'), {
  onEnter: function(args) {
    if (args[1].toInt32() === 0) { // kSSLSessionOptionBreakOnServerAuth
      args[2] = ptr(1);
    }
  }
});

SSL-Kill-Switch2 focuses specifically on disabling SSL certificate validation in iOS apps, while Frida provides a more general-purpose framework for dynamic instrumentation and modification of running processes across multiple platforms.