Skip to content
BranchesTags

Latest commit

 

History

46 Commits

Folders and files

NameName
Last commit message
Last commit date
README.md
README.md
 
 

Repository files navigation

iOS iOS

IOS App Pentesting Checklist

Welcome to the "IOS App Penetration Testing Checklist" Repository!

Explore the ultimate companion for IOSapp penetration testing, meticulously crafted to identify vulnerabilities in network, data, storage, and permissions effortlessly. This repository merges a comprehensive checklist of tasks and cutting-edge techniques, providing security professionals with a robust framework for a thorough security assessment of IOS applications.

The checklist covers a range of topics, including:

Static analysis: reviewing the app's source code and resources for potential vulnerabilities

Dynamic analysis: analyzing the app's behavior and interactions with the device and network during runtime

Network analysis: analyzing the app's communication with servers and other external resources over the network

Permission analysis: reviewing the app's requested permissions and assessing whether they are appropriate and secure

Cryptographic analysis: reviewing the app's use of cryptography and ensuring that it is implemented securely

Data storage analysis: analyzing the app's handling of sensitive data, including how it is stored and transmitted

This checklist is intended as a starting point for penetration testers and bug bounty hunters to identify common security issues in IOS applications. It is not a comprehensive guide to all possible security issues and should be used in conjunction with other resources and best practices.

Table of Content

Important Tools

#Tools-Installation

Grapefruit Installation

Grapefruit is an IOS app assessment tools that is using the FRIDA server on the iOS Device and is abstracting many penetration testing tasks in to a Web UI. It can be installed via npm.

npm install -g igf


grapefruit

With Grapefruit it's possible to explore different kinds of information concerning an iOS app. Once you selected the iOS app you can perform many tasks such as:

  • Get information about the binary
  • View folders and files used by the application and download them
  • Inspect the Info.plist
  • Get a UI Dump of the app screen shown on the iOS device
  • List the modules that are loaded by the app
  • Dump class names
  • Dump keychain items

ios-deploy Installation

With ios-deploy you can install and debug iOS apps from the command line, without using Xcode. It can be installed via brew on macOS:

brew install ios-deploy

Alternatively:

git clone https://github.com/ios-control/ios-deploy.git
cd ios-deploy/
xcodebuild
cd build/Release
./ios-deploy
ln -s <your-path-to-ios-deploy>/build/Release/ios-deploy /usr/local/bin/ios-deploy

The last line creates a symbolic link and makes the executable available system-wide. Reload your shell to make the new commands available:

zsh: # . ~/.zshrc
bash: # . ~/.bashrc

SwiftShield Installation

SwiftShield ↗ is a tool that generates irreversible, encrypted names for your iOS project's objects (including your Pods and Storyboards). This raises the bar for reverse engineers and will produce less helpful output when using reverse engineering tools such as class-dump and Frida.

A sample Swift project is used to demonstrate the usage of SwiftShield.

Check out (sushi2k/SwiftSecurity ↗.) Open the project in Xcode and make sure that the project is building successfully (Product / Build or Apple-Key + B). (Download ↗) the latest release of SwiftShield and unzip it. Go to the directory where you downloaded SwiftShield and copy the swiftshield executable to /usr/local/bin:

cp swiftshield/swiftshield /usr/local/bin/

In your terminal go into the SwiftSecurity directory (which you checked out in step 1) and execute the command swiftshield (which you downloaded in step 3):

$ cd SwiftSecurity
$ swiftshield -automatic -project-root . -automatic-project-file SwiftSecurity.xcodeproj -automatic-project-scheme SwiftSecurity

SwiftShield is now detecting class and method names and is replacing their identifier with an encrypted value.

In the original source code you can see all the class and method identifiers:

image

SwiftShield was now replacing all of them with encrypted values that leave no trace to their original name or intention of the class/method:

image

optool Installation

optool ↗ is a tool which interfaces with MachO binaries in order to insert/remove load commands, strip code signatures, resign, and remove aslr.

To install it:

git clone https://github.com/alexzielenski/optool.git
cd optool/
git submodule update --init --recursive
xcodebuild
ln -s <your-path-to-optool>/build/Release/optool /usr/local/bin/optool

The last line creates a symbolic link and makes the executable available system-wide. Reload your shell to make the new commands available:

zsh: # . ~/.zshrc
bash: # . ~/.bashrc

BinaryCookieReader Installation

A tool to dump all the cookies from the binary Cookies.binarycookies file

Python BinaryCookieReader.py [Cookie.binarycookies-file-path]

https://github.com/as0ler/BinaryCookieReader/blob/master/BinaryCookieReader.py

nm Installation

nm is a tool that displays the name list (symbol table) of the given binary. You can find here more information for for iOS.

Frida on iOS Installation Installing Frida on iOS

Start Cydia and add Frida's repository by navigating to Manage -> Sources -> Edit -> Add and entering https://build.frida.re ↗. You should then be able to find and install the Frida package.

$ frida-ps -U
PID  Name
---  ----------------
963  Mail
952  Safari
416  BTServer
422  BlueTool
791  CalendarWidget
451  CloudKeychainPro
239  CommCenter
764  ContactsCoreSpot

Frida on iOS Installation

Install Xcode Command Line Tools: plutil is part of the Xcode Command Line Tools package. You can install it by running the following command in Terminal:

xcode-select --install
plutil -p file_name.plist

Frida on iOS Installation iOSbackup is a Python 3 class that reads and extracts files from a password-encrypted iOS backup created by iTunes on Mac and Windows.

pip3 install iOSbackup --user

iOSbackup Installatio

iOSbackup requires other two packages: biplist and pycryptodome that will be installed automatically by pip.

pycryptodome has an API compatible with older pycrypto, which should also work with iOSbackup. But pycryptodome is more well maintained and easier to install on Windows and macOS.

Usage

>>> from iOSbackup import iOSbackup

>>> iOSbackup.getDeviceList()
[{'udid': '00456030-000E4412342802E',
  'name': 'mobileavi',
  'ios': '13.2.3',
  'serial': 'DNPPQRS0N4RW',
  'type': 'iPhone12,3',
  'encrypted': True},
{'udid': '00654030-01234412342802E',
  'name': 'ipad',
  'ios': '13.1.3',
  'serial': 'DABCRS0N4RW',
  'type': 'iPad10,1',
  'encrypted': True}]

usbmuxd Installatio

usbmuxd is a socket daemon that monitors USB iPhone connections. You can use it to map the mobile device's localhost listening sockets to TCP ports on your host computer. This allows you to conveniently SSH into your iOS device without setting up an actual network connection. When usbmuxd detects an iPhone running in normal mode, it connects to the phone and begins relaying requests that it receives via /var/run/usbmuxd.

Debian / Ubuntu Linux

First install all required dependencies and build tools:

sudo apt-get install \
	build-essential \
	pkg-config \
	checkinstall \
	git \
	autoconf \
	automake \
	libtool-bin \
	libplist-dev \
	libusbmuxd-dev \
	libimobiledevice-dev \
	libimobiledevice-glue-dev \
	libusb-1.0-0-dev \
	udev

If systemd is not installed and should control spawning the daemon use:

sudo apt-get install \
	systemd

Then clone the actual project repository:

git clone https://github.com/libimobiledevice/usbmuxd.git
cd usbmuxd

Now you can build and install it:

./autogen.sh
make
sudo make install

If you require a custom prefix or other option being passed to ./configure you can pass them directly to ./autogen.sh like this:

./autogen.sh --prefix=/opt/local --without-preflight --without-systemd
make
sudo make install

To output a list of available configure options use:

./autogen.sh --help

OR

submuxd --help
man

class-dump Installatio

class-dump by Steve Nygard is a command line utility for examining the Objective-C runtime information stored in Mach-O (Mach object) files. It generates declarations for the classes, categories, and protocols.

[submuxd](http://stevenygard.com/projects/class-dump/)
http://stevenygard.com/download/class-dump-3.5.dmg

** Radare2 Installation **

Radare2 ↗ is a complete framework for reverse-engineering and analyzing binaries. The installation instructions can be found in the GitHub repository. To learn more on radare2 you may want to read the official radare2 book ↗.

Install On Mac:

brew install radare2

Usage Tools

Objection Usage

Show the different storage locations belonging to the app

OWASP.iGoat-Swift on (iPhone: 12.0) [usb] # env

Disable popular ssl pinning methods

OWASP.iGoat-Swift on (iPhone: 12.0) [usb] # ios sslpinning disable

Dump the Keychain

OWASP.iGoat-Swift on (iPhone: 12.0) [usb] # ios keychain dump

Dump the Keychain, including access modifiers. The result will be written to the host in myfile.json

OWASP.iGoat-Swift on (iPhone: 12.0) [usb] # ios keychain dump --json <myfile.json>

Show the content of a plist file

OWASP.iGoat-Swift on (iPhone: 12.0) [usb] # ios plist cat <myfile.plist>
OWASP.iGoat-Swift on (iPhone: 12.0) [usb] # ios hooking list classes
OWASP.iGoat-Swift on (iPhone: 12.0) [usb] # ios hooking list class_methods <ClassName>
OWASP.iGoat-Swift on (iPhone: 12.0) [usb] # ios bundles list_bundles

Connecting to a patched IPA

$ objection explore

or

$ objection -g <id process app> explore

Using frida-ps to get the correct application name

$ frida-ps -Ua | grep -i Telegram
983  Telegram

Connecting to the Telegram app through Frida-server

$ objection --gadget="Telegram" explore

*** How to install IPA file into simulator IOS***

$ xcrun simctl list

all simulator will display and looking at booted simulator

$ xcrun simctl install BAB8FD1D-2503-45A9-9C2D-01F657F14453 /Users/name/Downloads/Testapp.app

*** Static Information Gathering***

$ unzip MyApp.ipa -d MyApp_extracted
$ plutil -p extracted_app/Payload/AppName.app/Info.plist
$ strings extracted_app/Payload/AppName.app/Info.plist

Inside, you'll find:
	Payload/ → Contains the actual app .app bundle
	iTunesMetadata.plist → Metadata for the app
	Info.plist → Main configuration file

🔴 Vulnerable Settings:
	✅ NSAllowsArbitraryLoads = YES → App allows insecure HTTP requests
	✅ UIFileSharingEnabled = YES → Allows access to app files via iTunes
	✅ CFBundleURLSchemes → Exposes custom URL schemes (potential attack surface)

*** Static Analysis of the IPA File***

$ cd MyApp_extracted/Payload/MyApp.app

$ ls -l

*** Analyze the App Binary***

$ file MyApp

Example output:
	MyApp: Mach-O 64-bit executable arm64

This confirms that it's a Mach-O binary compiled for arm64.

*** Check for Hardcoded Secrets***

$ strings MyApp | grep -i "password\|secret\|key\|token\|HTTP\|USERNAME\|username\|passw\|http\|credentials\|login\|backup\|logs\|log"
$ strings extracted_app/Payload/AppName.app/AppName | grep -i "key\|token\|password"
$ grep -r "password\|secret\|api_key" extracted_app/
Look for: ✅ Hardcoded API Keys
	✅ Embedded Credentials
	✅ Sensitive Debug Messages

*** Check for Hardcoded Secrets v2 ***

$ find /var/mobile/Containers/Data/Application/ -name "*.plist" > plish.txt

$ for file in $(cat ~/Documents/IO-Sys/plist.txt); do strings "$file" | grep -i -E "token\|username\|password\|pass\|http\|api\|user\|log\|logs\|backup"; done

$ strings Runner | grep -i "secret\|password\|apikey\|token\|http\|https\|url\|urls\|string\|strings"

*** Dynamic Analysis on a Jailbroken Device***

Install the IPA on a Jailbroken iPhone
$ scp MyApp.ipa root@192.168.1.100:/var/mobile/Documents/

Then, install it using appinst:
$ appinst /var/mobile/Documents/MyApp.ipa

*** Bypass SSL Pinning***

If the app uses SSL pinning, bypass it with Frida:

$ frida -U -n MyApp -e "Interceptor.attach(Module.findExportByName(null, 'SSL_set_custom_verify'), { onEnter: function(args) { args[2] = 0; } });"

*** Dump Keychain Data***

$ frida -U -n MyApp -e "console.log(JSON.stringify(Keychain.dump(), null, 2))"
This will reveal stored passwords, API keys, or tokens.

*** Extract and Decrypt iOS IPA Files***

Some IPAs from the App Store are encrypted with Apple DRM (FairPlay). You can decrypt them using Frida:

$ frida -U -n MyApp -e "var mod = Module.findExportByName(null, '_platform_memcmp'); Interceptor.attach(mod, { onEnter: function(args) { this.args = args; }, onLeave: function(retval) { if (retval.toInt32() == 0) console.log(hexdump(args[1], {length: 32})); } });"

*** Inspect Info.plist for Security Misconfigurations***

The Info.plist file contains security settings for the app. Check for:

$ cat MyApp_extracted/Payload/MyApp.app/Info.plist

🔴 Vulnerable Settings: ✅ NSAllowsArbitraryLoads = YES → App allows insecure HTTP requests
			✅ UIFileSharingEnabled = YES → Allows access to app files via iTunes
			✅ CFBundleURLSchemes → Exposes custom URL schemes (potential attack surface)

*** Extracting App Entitlements***

$ codesign -d --entitlements - extracted_app/Payload/AppName.app

Look for Keychain Access Groups, Background Modes.

*** Checking Linked Libraries***

$ otool -L extracted_app/Payload/AppName.app/AppName
$ nm -U extracted_app/Payload/AppName.app/AppName

Identify security-sensitive libraries.

*** Decompiling & Disassembling***

$ class-dump -H extracted_app/Payload/AppName.app -o headers/
$ hopper extracted_app/Payload/AppName.app/AppName


Extract Objective-C headers.

*** Identifying Weak Cryptography***

$ strings extracted_app/Payload/AppName.app/AppName | grep -i "md5\|sha1\|base64\|aes"

Avoid MD5, SHA1, use AES-256.

*** Identifying Insecure Data Storage***

$ find extracted_app -name "*.db"
$ find extracted_app -name "*.plist"
$ find extracted_app -name "*.log"


Look for SQLite databases, plist files, logs.

*** Running the App in a Jailbroken Device***

Install Frida, Cycript, Objection for runtime analysis.
$ frida -U -n AppName -i

*** Bypassing Jailbreak Detection***

$ frida -U -n AppName -e 'Interceptor.attach(Module.findExportByName(null, "sysctl"), {onEnter: function(args) { args[1] = ptr("0");}})'

Avoid detection mechanisms checking /private/var/lib/apt/, cydia.app.

*** Hooking Functions Using Frida***

$ frida -U -n AppName -e 'Interceptor.attach(Module.findExportByName(null, "objc_msgSend"), {onEnter: function(args) { console.log("Method called: " + Memory.readUtf8String(args[1])); }})'

Hook and log Objective-C function calls.

*** Bypassing SSL Pinning***

$ frida -U -n AppName -e 'Interceptor.attach(Module.findExportByName(null, "SSLHandshake"), {onEnter: function(args) { args[0] = 0; console.log("SSL Pinning Bypassed!"); }})'

Disable SSL verification at runtime.

*** Inspecting Keychain Data***

$ keychain_dumper

Look for stored credentials, private keys.

📡 4. Network Security Testing

*** Capturing & Modifying Traffic (MITM)***

Use mitmproxy to intercept app traffic.

mitmproxy -p 8080

Route iOS device traffic through proxy.

*** Checking for Insecure Requests***

$ tcpdump -i any port 80

look for unencrypted HTTP traffic.

*** Testing API Endpoints***

$ curl -k -X POST "https://api.example.com/login" -d "username=admin&password=admin"

Test API security, parameter tampering.

🔓 5. Exploitation

*** Dumping Memory***

$ objection -g AppName explore
memory dump

Extract in-memory data.

*** Bypassing FaceID / TouchID***

$ objection -g AppName explore
$ ios biometrics bypass

Authenticate without valid biometrics.

*** Modifying Plist Files***

$ plutil -convert xml1 Info.plist
$ nano Info.plist

Modify permissions, configurations.

*** Modifying Runtime Behavior***

$ frida -U -n AppName -e 'Interceptor.attach(Module.findExportByName(null, "objc_msgSend"), {onEnter: function(args) { console.log("Intercepted Method: " + Memory.readUtf8String(args[1])); }})'

Inject hooks to modify app behavior.

Installing some tools via cydia jailbreaked

https://apt.bingner.com/ http://apt.thebigboss.org/repofiles/cydia/ https://repo.chariz.com/ https://repo.dynastic.co/ https://build.frida.re/ https://cydia.ichitaso.com/ https://ios.jjolano.me/ https://cydia.akemi.ai/ https://repo.co.kr/ https://repo.misty.moe/apt/ http://apt.modmyi.com/ https://ryleyangus.com/repo/ http://cydia.zodttd.com/repo/cydia/

Installation Tools

*** Installation KeyChain_dump On MacBook***

$ git clone https://github.com/ptoomey3/Keychain-Dumper.git
$ cd Keychain-Dumper

move keychain-dumper to iphone /private/var/root
keychian_dumper + enter

It will list all stored passwords, certificates, and sensitive tokens in macOS Keychain.

*** Checking Logs for Sensitive Data

*** Use strings to search for log statements:***

$ strings MyApp.app/MyApp | grep -i "NSLog\|NSAssert\|NSCAssert\|fprintf\|Logfile\|Logging"

If you see sensitive logs, the app might be leaking information in logs.

*** Decompile & Perform Source Code Review***

$ hopper MyApp.app/MyApp

Look for logging functions (NSLog, fprintf, etc.).
Check if logs expose sensitive information.

*** Identify Third-Party Libraries & SDKs***

$ strings Info.plist | grep -i "sdk\|api\|key\|analytics"
$ strings Runner | grep -r "http\|https"

Common third-party services:
	Firebase Analytics (GoogleService-Info.plist)
	Facebook SDK (FBSDK*)
	Crashlytics (fabric.apiKey)
	Ad SDKs (AdMob, MoPub, Adjust)

*** Check for hardcoded API endpoints:***

Open the decompiled app and search for URLs:

$ grep -r "http\|https" .

Ensure API requests are using HTTPS (NSAppTransportSecurity in Info.plist).

*** Inspect potential sensitive data sharing functions:***

Open the decompiled app and search for URLs:

$ grep -r "NSUserDefaults" .
$ grep -r "NSLog" .
$ grep -r "UIPasteboard" .

Bad Practices:
	Storing sensitive info in NSUserDefaults
	Logging sensitive data via NSLog
	Copying user data to UIPasteboard (clipboard)

Dynamic Analysis (Runtime Monitoring & Traffic Inspection) *** Monitor Network Traffic (MitM Attack)***

Use Burp Suite or MITM Proxy to intercept API traffic:

	Configure Burp Suite or mitmproxy on the iOS simulator or jailbroken device.
	Route all traffic through the proxy.
	Look for:
		Unencrypted data (HTTP instead of HTTPS)
		PII exposure (Usernames, emails, session tokens)
		Unnecessary API calls to third parties

Use tcpdump to capture traffic:
	$ tcpdump -i any -X -s 0 -w network.pcap
Analyze the .pcap file with Wireshark.

*** Monitor File & Keychain Access***

Check for insecure data storage:

$ frida -U -n AppName -e 'Interceptor.attach(Module.findExportByName(null, "NSUserDefaults"), { onEnter: function(args) { console.log("NSUserDefaults Accessed"); } });'

Look for sensitive information stored in:
	NSUserDefaults
	Keychain
	Cache or Documents folder

*** Monitor runtime logs with Frida***

Check for insecure data storage:

$ frida -U -n AppName -e 'console.log(NSLog)'

Check if sensitive info is being logged.

Testing a Flutter iOS .ipa File for Security Issues

*** Extract & Decompile .ipa File***

📌 Objective: Extract and analyze the app’s contents, including strings, libraries, and resources.
🚀 Steps to Test
✅ Convert .ipa to .zip and extract it

$ mv app.ipa app.zip && unzip app.zip -d extracted_app
$ cd extracted_app/Payload/Runner.app/

✅ Analyze the binary for sensitive information

$ strings Runner | grep -i "password"
$ strings Runner | grep -i "api_key"
$ strings Runner | grep -i "token"

✅ Check Flutter assets and bundled files

$ find . -name "*.json"
$ find . -name "*.xml"
$ find . -name "*.sqlite"
$ find . -name "*.db"
$ find . -type f

✅ List binary functions and symbols

$ nm Runner | grep -i "debug"



Fix: Do not store API keys, credentials, or sensitive data in assets or bundled files.

2️⃣ Static Analysis for Hardcoded Secrets
📌 Objective: Detect secrets or credentials hardcoded in the app binary.
🚀 Steps to Test
✅ Use rabin2 (from radare2) to find stored URLs and secrets

$ rabin2 -z Runner | grep -i "http"
$ rabin2 -z Runner | grep -i "token"
✅ Use nm to list symbols in the binary

nm Runner | grep -i "password"
📌 Fix: Use environment variables or encrypted storage instead of hardcoded values.

3️⃣ Check for Weak Permissions
📌 Objective: Analyze Info.plist for security misconfigurations.
🚀 Steps to Test
✅ Check permissions and security settings in Info.plist

$ cat Info.plist | grep -A5 -i "NSAllowsArbitraryLoads"
$ cat Info.plist | grep -A5 -i "UIFileSharingEnabled"
$ plutil -convert xml1 Info.plist -o Info.xml
$ cat Info.xml
$ grep -A3 -i "NSAllowsArbitraryLoads" Info.xml
$ grep -A3 -i "UIFileSharingEnabled" Info.xml

🔴 Red Flags:

NSAllowsArbitraryLoads=true (App allows insecure HTTP connections)
UIFileSharingEnabled=true (Users can access app files via USB)
📌 Fix: Set NSAllowsArbitraryLoads=false and UIFileSharingEnabled=false.

✅ Check if sensitive permissions are being misused

$ grep -E "NSLocationAlwaysUsageDescription|NSCameraUsageDescription|NSMicrophoneUsageDescription" Info.plist
📌 Fix: Set NSAllowsArbitraryLoads=false and disable file sharing if not needed.

4️⃣ Analyze Local Storage for Sensitive Data
📌 Objective: Detect if sensitive data is being stored in insecure locations.
🚀 Steps to Test
✅ Find SQLite databases and inspect stored data

$ find . -name "*.db"
$ sqlite3 app_data.db "SELECT * FROM users;"
✅ Check for plaintext logs in the app’s sandbox

$ find . -name "*.log"
$ cat Runner.log
📌 Fix: Use secure storage (flutter_secure_storage) and avoid logging sensitive data.

5️⃣ Dynamic Analysis: Run .ipa in a Jailbroken Device
📌 Objective: Detect runtime security flaws, memory leaks, and improper API usage.
🚀 Steps to Test
✅ Install the .ipa on a jailbroken iOS device

៛ ideviceinstaller -i app.ipa
✅ Use frida to inspect runtime API calls

$ frida -U -n Runner -e "Interceptor.attach(Module.findExportByName(null, 'objc_msgSend'), { onEnter: function(args) { console.log('Calling:', ObjC.Object(args[1]).toString()); }});"

✅ Use frida to bypass security checks

$ frida -U -n Runner -e "Interceptor.attach(Module.findExportByName(null, 'objc_msgSend'), { onEnter: function(args) { console.log('Calling:', ObjC.Object(args[1]).toString()); }});"

✅ Check for weak jailbreak detection

$ frida -U -n Runner -e "console.log('Jailbreak detected:', ObjC.classes.JailbreakDetection.checkJailbreak());"
📌 Fix: Enable jailbreak detection and use obfuscation techniques.
🔴 Red Flags:
	App fails to detect jailbroken environments
	Sensitive data is accessible on jailbroken devices
📌 Fix: Implement jailbreak detection (e.g., checking for cydia:// or /private/var/lib/apt/).


6️⃣ Network Security: Perform MITM Attack
📌 Objective: Check for insecure API requests and plaintext data transmission.
🚀 Steps to Test
✅ Set up a proxy using Burp Suite and intercept network traffic

Run Burp Suite and configure it as a proxy
Configure the iOS Simulator to route traffic through Burp
Intercept and analyze network traffic
✅ Find unencrypted requests

$ grep -i "http://" burp_proxy.log
📌 Fix: Enforce HTTPS and use SSL pinning to prevent MITM attacks.

🚀 Steps to Test
✅ Set up a proxy with Burp Suite

Open Burp Suite → Proxy → Intercept
Configure iOS to use Burp's proxy (Wi-Fi Settings → Proxy)
Intercept network traffic while using the app
✅ Look for insecure HTTP API calls

$ grep -i "http://" burp_proxy.log
✅ Test SSL/TLS Certificate Pinning

If SSL Pinning is enabled, Burp will fail to intercept traffic
If SSL Pinning is NOT enabled, you can see API requests
📌 Fix: Enforce HTTPS-only connections and implement SSL Pinning.

7️⃣ Reverse Engineering: Disassemble & Analyze Code
📌 Objective: Disassemble the .ipa and look for security vulnerabilities.
🚀 Steps to Test
✅ Use Hopper or Ghidra to decompile the app binary

Open Runner in Hopper Disassembler or Ghidra
Analyze class names and function calls
Search for keywords like "password", "secret", "key"
✅ Use class-dump to extract class structures

$ class-dump -H Runner -o output_dir
📌 Fix: Use Dart obfuscation and remove debugging symbols before release.

✅ Use Hopper Disassembler or Ghidra for deep analysis

Load Runner binary in Hopper Disassembler
Search for passwords, API keys, or encryption logic
✅ Check for weak encryption methods

$ strings Runner | grep -i "AES"
$ strings Runner | grep -i "MD5"
🔴 Red Flags:
	Weak encryption (MD5, DES) found
	Sensitive data (API keys, passwords) visible in disassembly
📌 Fix: Use strong encryption (AES-256, SHA-256) and obfuscate sensitive logic.


💾 8 Local Storage Analysis
📌 Objective: Check if sensitive data is stored in an insecure location.
🚀 Steps to Test
✅ Find SQLite databases, logs, and cache files

$ find . -name "*.db" -o -name "*.log" -o -name "*.sqlite"

✅ Extract and inspect SQLite databases

$ sqlite3 app_data.db "SELECT * FROM users;"
$ sqlite3 app_data.db ".tables"

✅ Check if sensitive data is in NSUserDefaults (plaintext storage)

$ grep -r "NSUserDefaults" .

🔴 Red Flags:
	User credentials or tokens stored in SQLite database unencrypted
	Logging sensitive data in .log files

	📌 Fix: Use Flutter Secure Storage or Keychain Services to securely store credentials.

🚨 6. Post-Exploitation & Reporting 6.1 Common Vulnerabilities & Fixes Vulnerability Impact Fix Hardcoded Credentials API abuse, data exposure Use secure storage (Keychain) Weak Encryption (MD5, SHA1) Data leakage Use AES-256 Insecure Data Storage Data compromise Encrypt sensitive data ATS Disabled MITM attack Enforce HTTPS Jailbreak Detection Bypass Security bypass Implement multiple checks 6.2 Remediation Checklist ✔ Use Secure Enclaves & Keychain for Sensitive Data ✔ Enforce SSL Pinning & HTTPS Only Connections ✔ Encrypt Sensitive Data Before Storage ✔ Harden Jailbreak Detection ✔ Use Static & Dynamic Analysis Tools for Security Audits

🛠️ Best iOS Penetration Testing Tools Tool Usage Frida Runtime instrumentation Objection Bypass protections Class-dump Extract Objective-C headers Hopper / Ghidra Reverse engineering Keychain_dumper Extract saved credentials MobSF Automated app analysis mitmproxy MITM attack & network sniffing SSLKillSwitch2 Bypass SSL pinning 🛡️ Advanced iOS Security Hardening ✔ Enable ATS (App Transport Security) ✔ Implement Strong SSL Pinning ✔ Use Secure Storage for API Keys & Passwords ✔ Harden Binary with Anti-Debugging Techniques ✔ Implement Strong Runtime Integrity Checks ✔ Use Secure Communication Libraries

*** To Install IPA File to Iphone**

Go to download from website: https://sideloadly.io/
then install -> drop file IPA and login with Apple ID

About

No description, website, or topics provided.

Resources

Readme
Activity

Stars

0 stars

Watchers

1 watching

Forks

2 forks
Report repository

Releases

Packages

Contributors