skills.rest
bingook
bingookCOMMUNITY
Explore all skills by this author →
GitHub

macos-process-injection

Provides macOS code injection via DYLD hijacking, XPC exploits, Mach ports, MIG abuse, and Electron targeting.

Updated Aug 23, 2026
Search Tags:#macos#process injection#dylib hijacking#xpc exploitation#mach port#mig abuse#electron injection
One-click install
npx skills add https://github.com/bingook/bingo --skill macos-process-injection-bingook
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: macos-process-injection
Source: https://github.com/bingook/bingo/tree/main/bingo/skills/hack-skills/macos-process-injection
Command: npx skills add https://github.com/bingook/bingo --skill macos-process-injection-bingook

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill provides expert-level techniques for injecting code into macOS processes, enabling advanced attacks such as dylib hijacking, XPC exploitation, and Mach port manipulation.

Core Features & Use Cases

  • DYLD Injection: Use DYLD environment variables to preload attacker-controlled dylibs.
  • DYLIB Hijacking: Exploit the dynamic linker's library search order to load malicious libraries.
  • XPC Exploitation: Abuse macOS's XPC mechanism for cross-process communication.
  • Mach Port Manipulation: Directly manipulate Mach ports for kernel-level IPC.
  • MIG Abuse: Exploit vulnerabilities in MIG subsystems for code injection.
  • Electron/Chromium Injection: Target Electron and Chromium-based applications for code injection.
  • Application Scripting: Use AppleScript to control applications and inject code.
  • Process Injection Decision Tree: A comprehensive guide for selecting the right injection technique based on the target application's characteristics.

Quick Start

Load the macos-process-injection skill and target the application 'target.app' with the injection technique 'DYLD_INSERT_LIBRARIES'.

Frequently Asked Questions about macos-process-injection

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform process injection on macOS targeting a specific application?▼

The Skill provides a process injection decision tree to help you select the right technique, such as DYLD injection or XPC exploitation, based on the target application's characteristics and security mechanisms.

What is dylib hijacking and how does it work on macOS?▼

Dylib hijacking is a macOS process injection technique that exploits the dynamic linker's library search order to load attacker-controlled malicious libraries into a target application instead of legitimate ones.

Can I use XPC exploitation and Mach port manipulation for cross-process code injection?▼

Yes, you can use XPC exploitation to abuse macOS's cross-process communication mechanism, and Mach port manipulation to directly manipulate kernel-level IPC for injecting code into running processes.

Does this process injection approach work with Electron and Chromium-based applications?▼

Yes, the techniques include specialized Electron and Chromium injection methods designed to target and inject code into applications built on these frameworks.

What macOS internals knowledge do I need to effectively use MIG abuse for code injection?▼

Using MIG abuse for code injection requires advanced knowledge of macOS internals, specifically understanding MIG subsystems, Mach IPC, and security mechanisms to exploit vulnerabilities successfully.

Related Skills

Explore More Software Engineering Skills→
DorianGalloDorianGallo
5

macos-process-injection

Guides macOS code injection via DYLD, XPC/Mach IPC weaknesses, and Electron runtimes for security assessment scenarios.

Community
Advanced
0x0pointer0x0pointer
13

post-exploit

Escalate privileges, harvest credentials, and enumerate compromised Linux and Windows hosts.

Official
Advanced
lNwNllNwNl
2

macos-process-injection

Analyze macOS process injection vectors via DYLD, XPC, Mach IPC, and Electron runtime features.

Community
Advanced
cmndcntrlcybercmndcntrlcyber
3

hunt-ssrf

Detects and exploits Server-Side Request Forgery vulnerabilities in web applications.

Community
Advanced