Grapefruit: Open-source mobile security testing suite

Runtime mobile application instrumentation toolkit powered by Frida. Inspect, hook, and modify mobile apps through a web-based interface.

Now it supports both iOS and Android!

Quick Start

Requires Frida server running on your device. Follow the official setup guides(Android) first.

npm (recommended, requires Node.js 22.18+)

npm install -g igf
igf

Or run without installing (requires Node.js 22.18+)

npx igf

Prebuilt binaries for macOS, Linux, and Windows are available on GitHub Releases. Both source development and prebuilt executables use Node.js; see the development guide for the npm workflow.

Usage

igf [options]           Start the server (default)

Options:
  --frida <16 | 17>      Frida version to use (default: 17)
  --host <host>          Host to bind (default: 127.0.0.1)
  --port <port>          Port to bind (default: 31337)
  --project <path>       Project directory for data/cache/logs (default: .igf in cwd)
  --no-open              Do not open browser on startup
  --help, -h             Show help message

Environment Variables

Command-line flags take precedence over environment variables when both are set.

Features

• Runtime Method Hooking - Intercept native and managed functions with structured logging
• Cryptographic API Interception - Monitor encryption/decryption operations with data capture
• Filesystem Browser - Navigate, upload, download, and inspect files with hex/text preview
• SQLite Database Inspection - Browse tables, run queries, and view results
• Syslog Streaming - Real-time system and agent log monitoring
• Process Crash Reporting - Exception handler with register dump and backtrace
• Flutter Support - Monitor platform method channel communication on both platforms
• React Native Support - Bridge inspector and JavaScript injection REPL
• Memory Scanner - Search and inspect process memory
• Privacy Monitor - Track sensitive API access (camera, microphone, location, sensors, etc.)
• Thread Inspector - View and manage process threads
• Module/Symbol Browser - Inspect loaded modules and exported symbols
• Analysis & Decompilation - DEX, Hermes bytecode, and native code. AI assistance available for hook script generation

iOS

• Keychain access and modification
• NSURL session traffic capture (HTTP/HTTPS/WebSocket)
• WebView and JSContext inspection with JavaScript execution
• UI hierarchy dump and element highlighting
• Info.plist, entitlements, and binary cookie viewers
• Biometric (Touch ID / Face ID) bypass
• UserDefaults browser
• Pasteboard and file operation monitoring
• Geolocation spoofing
• Device ID spoofing
• Objective-C class and method inspection
• Open file handles and network connections (lsof)
• Security analysis (PIE, ARC, stack canaries, encryption)
• Asset catalog viewer (Assets.car)
• XPC/NSXPC message inspection

Android

• AndroidManifest.xml decoder and component browser (activities, services, receivers, providers)
• Android Keystore inspection with key attributes
• Content provider query, insert, update, and delete
• JNI call tracing with arguments, return values, and backtraces
• Java class inspection (methods, fields, interfaces)
• Intent building and launching
• Open file handles and network connections (lsof)
• HTTP traffic capture (OkHttp, Volley, URLConnection)
• Resources browser
• Clipboard and SharedPreferences monitoring
• Broadcast receiver monitoring

Documentation

• CLI and Daemon
• Development
• Architecture
• RPC
• Acknowledgements

Scope and Non-Goals

This project does not include built-in bypasses for anti-tampering protections:

• Frida detection bypass
• SSL/TLS certificate pinning bypass
• Jailbreak or root detection bypass

Rationale: RASP (Runtime Application Self-Protection) solutions evolve continuously to detect instrumentation frameworks. Maintaining effective bypasses requires ongoing effort to keep pace with new detection methods, introducing significant maintenance burden and potential stability issues. These bypasses are also highly application-specific, making general-purpose solutions fragile.

Rather than shipping brittle built-in bypasses, Grapefruit focuses on instrumentation and inspection capabilities that compose well with dedicated bypass tooling.

Recommended approaches for authorized assessments where RASP bypass is required:

1. Frida Syscall Tracer — Use frida-strace (Frida 17.8.0+) to trace system calls in the target process. This helps identify detection artifacts and determine what patches are needed before attaching Grapefruit:

   root@kitploit:~

   frida-strace -U -f com.example.app
   

   See the Frida 17.8.0 release notes for details.

2. Multi-session Architecture — Frida supports multiple sessions attached to the same process. Spawn a separate session with your RASP bypass scripts first, then launch Grapefruit. When Grapefruit detects that the target app is already running, it attaches to the existing process rather than respawning it, preserving any bypasses already in effect.

Security

Grapefruit binds to 127.0.0.1 by default and has no built-in authentication. The web UI and API are accessible to any local process. While cross-origin requests are blocked by default (no CORS headers, Socket.IO rejects cross-origin connections), this alone is not sufficient for a shared or remote environment.

If you need remote access or multi-user security, put Grapefruit behind an authenticated reverse proxy such as Caddy for TLS, access control, and logging. Do not expose Grapefruit directly to the network without authentication.

License

MIT