Basic identity
Collects username/full name, computer and local host names, macOS version/build, model, CPU, memory, and serial number.
Authorized macOS Reconnaissance
Recon
Recon is an information-gathering script intended for authorized security testing. It collects system, network, Wi-Fi credential, browser, login-item, and disk information into a timestamped ZIP archive saved beside the script.
Important: Recon collects privacy-sensitive data, including saved Wi-Fi passwords and browser artifacts. Optional Dropbox or Discord upload settings can transmit the resulting ZIP when configured. Use it only on a Mac you own or are explicitly authorized to inspect.
Installation
Using the Melding Software Mac installer
Copy and paste this command into Terminal to install the Melding Software Mac scripts.
After reopening Terminal, type MeldingSoftware anytime to load the list.
curl -fsSL https://raw.githubusercontent.com/MeldingSoftware/Scripts/main/Mac/install.sh | bash
Because this command downloads and immediately runs a shell installer, you can review install.sh in the GitHub repository before executing it. Individual scripts may also request permissions, administrator access, Keychain authorization, Full Disk Access, or other macOS approvals depending on what the selected tool needs.
Documentation
System and network collection
Public and local networking
Requests the public IP from api.ipify.org and captures local interface information.
Disk information
Appends df -h output to the collected computer data.
Documentation
Wi-Fi credentials
Current SSID
Attempts to read the currently connected Wi-Fi network.
Saved networks
Reads known-network data from macOS preferences where available.
Keychain password lookup
Uses the macOS security command to retrieve saved AirPort network passwords when access is permitted.
Nearby networks
Attempts to list nearby Wi-Fi networks with Apple's airport utility.
Documentation
Browser artifacts
Browsers are closed first
The script attempts to quit Safari, Google Chrome, Microsoft Edge, and Firefox to improve access to browser data files.
Chrome and Edge
Uses strings and URL matching against History and Bookmarks files for Default and numbered profiles.
Firefox
Checks places.sqlite and favicons.sqlite under Firefox profiles.
Safari
Checks Safari History.db files when macOS privacy permissions allow access.
URLs only
The current extraction is a crude URL-oriented strings scan rather than a full structured browser-history parser.
Documentation
Additional artifacts and packaging
Login items
Collects login item names through System Events.
LaunchAgents and recent files
Lists the user's LaunchAgents directory and a recent home-directory listing.
ZIP output
Compresses the temporary collection directory to a timestamped ZIP next to the script.
Optional uploads
If configured, Dropbox or Discord credentials/webhooks can upload the generated archive.
Cleanup
Deletes the temporary working folder after packaging but intentionally keeps the resulting ZIP.
FAQ
Frequently asked questions
Is Recon local-only?
By default the Dropbox token and Discord webhook variables are empty. If either is populated, the script can upload the ZIP.
Does it collect saved Wi-Fi passwords?
Yes, when macOS Keychain access permits the security lookup.
Does it close browsers?
Yes. It attempts to close Safari, Chrome, Edge, and Firefox before browser-artifact extraction.
Where is the ZIP saved?
Beside the Recon script.
Is this intended for arbitrary third-party devices?
No. The script itself labels its use as authorized security testing/red-team activity.