What is thick-client-pentesting-on-macos?

This repository is a reference guide for security professionals who want to test the security of macOS desktop applications, a practice known as thick client pentesting. Thick client refers to full desktop apps installed directly on a Mac, as opposed to websites running in a browser. Testing these apps for security weaknesses requires different techniques than web testing, and consolidated resources for macOS have historically been harder to find than for Windows or Linux. The guide draws on research from CyberArk Labs, published in three parts, alongside community write ups. It covers a four phase attack chain: reconnaissance, meaning mapping out how the app is structured, static analysis, meaning examining code and configuration without running it, dynamic analysis, meaning probing the app while it runs, and exploitation, meaning attempting attack techniques such as dylib hijacking, DYLD injection, and XPC attacks. Dylib hijacking means tricking an app into loading a malicious code library in place of the legitimate one. XPC is a macOS inter process communication system that, when poorly configured, can be abused to escalate privileges. Topics covered include macOS security controls such as System Integrity Protection, Gatekeeper, App Sandbox, and Transparency Consent and Control, as well as dynamic analysis tools like Frida, lldb, and DTrace, and static analysis commands using codesign and otool. The guide targets native macOS apps written in Swift, Objective-C, or C and C++, tested on macOS 10.15 (Catalina) and later. This is a resource for ethical hackers, bug bounty researchers, and security engineers who have authorization to test macOS applications. The full README is longer than what was provided.