Ios Pentesting Tricks

SKILL: iOS Pentesting Tricks — Expert Attack Playbook

AI LOAD INSTRUCTION: Expert iOS application security testing techniques. Covers jailbreak vs non-jailbreak methodology, keychain extraction, URL scheme/Universal Links abuse, Frida/Objection runtime hooks, binary protection checks, and data storage analysis. Base models miss protection class nuances and AASA misconfiguration patterns.

0. RELATED ROUTING

Before going deep, consider loading:

• mobile-ssl-pinning-bypass for in-depth SSL pinning bypass (SecTrust hooks, SSL Kill Switch, framework-specific techniques)
• android-pentesting-tricks when also testing the Android version of the same app
• api-sec for backend API security testing once traffic is intercepted

Advanced Reference

Also load IOS_RUNTIME_TRICKS.md when you need:

• Frida recipes for iOS-specific hooks (ObjC class enumeration, method swizzling)
• Objection command reference for iOS
• Runtime hooking patterns and bypass templates

---

1. JAILBREAK VS NON-JAILBREAK TESTING

Non-Jailbreak Testing Setup

# Extract IPA from device
ideviceinstaller -l                    # List installed apps
ios-deploy --id <UDID> --download --bundle_id com.target.app

# Or use frida-ios-dump for decrypted IPA (jailbroken)
python dump.py com.target.app

# Sideload with Frida gadget (non-jailbreak runtime hooking)
# 1. Extract IPA, 2. Insert FridaGadget.dylib into Frameworks/
# 3. Re-sign with valid profile, 4. Install via ios-deploy

---

2. KEYCHAIN EXTRACTION

2.1 Keychain Protection Classes

2.2 Extraction Methods

# Jailbroken: keychain-dumper
/path/to/keychain-dumper -a              # Dump all accessible items
/path/to/keychain-dumper -g password     # Generic passwords only
/path/to/keychain-dumper -i              # Internet passwords

# Frida / Objection
objection -g com.target.app explore
> ios keychain dump
> ios keychain dump --json                # JSON output for parsing

# Frida script for keychain enumeration
frida -U -f com.target.app -l keychain_dump.js

2.3 What to Look For

---

3. URL SCHEME HIJACKING

3.1 Custom URL Scheme Discovery

# From IPA/app bundle — check Info.plist
plutil -p /path/to/Payload/Target.app/Info.plist | grep -A 10 CFBundleURLTypes

# Example output:
# "CFBundleURLSchemes" => ["targetapp", "fb123456789"]

3.2 Hijacking Attack

Scenario: Target app registers "targetapp://" for OAuth callback

1. Attacker app also registers "targetapp://" URL scheme
2. User initiates OAuth login in target app
3. OAuth provider redirects to targetapp://callback?code=AUTH_CODE
4. iOS may open attacker's app instead (non-deterministic scheme resolution)
5. Attacker captures OAuth authorization code

3.3 URL Scheme vs Universal Links Security

---

4. UNIVERSAL LINKS EXPLOITATION

4.1 AASA (Apple-App-Site-Association) Misconfiguration

# Fetch AASA file
curl -s "https://target.com/.well-known/apple-app-site-association" | jq .
curl -s "https://target.com/apple-app-site-association" | jq .

# Check for wildcard patterns (overly broad)
# Bad: "paths": ["*"]     ← captures ALL URLs
# Bad: "paths": ["/NOT *"] ← poorly written exclusion

4.2 Breaking Universal Links → URL Scheme Fallback

Technique: Force Universal Link to not open app, causing fallback to URL scheme

1. User long-presses link → "Open in Safari" (disables UL for that domain)
2. Redirect chain: domain A → domain B → target (UL breaks on redirect)
3. JavaScript redirect instead of 302 (UL only works on server-side redirects)
4. App not installed → URL scheme fallback → hijackable

---

5. RUNTIME MANIPULATION

5.1 Frida on iOS

# Connect to app on jailbroken device
frida -U -f com.target.app --no-pause

# Basic ObjC exploration
> ObjC.classes                                    # List all classes
> ObjC.classes.NSURLSession                       # Check if class exists
> ObjC.classes.AppDelegate.$methods               # List methods
> ObjC.classes.AppDelegate['- isLoggedIn'].implementation  # Read method

# Hook method and modify return value
Interceptor.attach(ObjC.classes.AuthManager['- isAuthenticated'].implementation, {
    onLeave: function(retval) {
        retval.replace(ptr(1));  // Force return TRUE
    }
});

5.2 Objection iOS Commands

objection -g com.target.app explore

# Keychain
> ios keychain dump

# Cookies
> ios cookies get

# Pasteboard
> ios pasteboard monitor

# Jailbreak detection bypass
> ios jailbreak disable

# SSL pinning bypass
> ios sslpinning disable

# Binary info
> ios info binary

# Hooking
> ios hooking watch class AppDelegate
> ios hooking watch method "-[AuthManager isAuthenticated]" --dump-args --dump-return
> ios hooking set return_value "-[AuthManager isJailbroken]" false

5.3 Cycript (Legacy but Useful)

// Attach to running app
cycript -p com.target.app

// Explore UI hierarchy
UIApp.keyWindow.recursiveDescription().toString()

// Find view controllers
[UIWindow.keyWindow().rootViewController _printHierarchy].toString()

// Call methods directly
[AppDelegate.sharedInstance isLoggedIn]  // → check return
AppDelegate.sharedInstance.isLoggedIn = true  // → modify

// Access singleton instances
var vc = choose(LoginViewController)[0]
vc.bypassLogin()

---

6. BINARY PROTECTIONS

6.1 Checking Binary Security

# PIE (Position Independent Executable)
otool -hv /path/to/binary | grep PIE

# ARC (Automatic Reference Counting)
otool -I -v /path/to/binary | grep objc_release

# Stack canaries
otool -I -v /path/to/binary | grep __stack_chk_guard

# Encryption (FairPlay DRM)
otool -l /path/to/binary | grep -A 4 LC_ENCRYPTION_INFO
# cryptid 0 = decrypted, cryptid 1 = encrypted

6.2 Decrypting IPA

# frida-ios-dump (preferred, jailbroken device)
python dump.py com.target.app
# Outputs: decrypted IPA in current directory

# bagbak (alternative)
bagbak com.target.app

# Manual via Frida
frida -U -f com.target.app -l dump_memory.js
# Dump decrypted binary from memory, replace encrypted section

6.3 Class-dump for ObjC Analysis

# Dump Objective-C class information
class-dump /path/to/decrypted/binary > classes.h
class-dump -H /path/to/decrypted/binary -o /tmp/headers/

# Search for interesting patterns
grep -r "password\|token\|secret\|apiKey\|isJailbroken\|isRooted" /tmp/headers/

---

7. DATA STORAGE ISSUES

7.1 Sensitive Data Locations

7.2 Inspection Commands

# On jailbroken device — app sandbox at:
# /var/mobile/Containers/Data/Application/<UUID>/

# Find app UUID
find /var/mobile/Containers -name "com.target.app" 2>/dev/null

# Check NSUserDefaults
plutil -p Library/Preferences/com.target.app.plist

# Check SQLite databases
sqlite3 Library/Application\ Support/Model.sqlite ".tables"
sqlite3 Library/Application\ Support/Model.sqlite "SELECT * FROM ZUSER;"

# Check for sensitive strings in all files
grep -r "password\|token\|bearer\|api_key" Documents/ Library/

---

8. TRANSPORT SECURITY (ATS)

8.1 ATS Exception Patterns

<!-- Info.plist — check for ATS exceptions -->
<key>NSAppTransportSecurity</key>
<dict>
  <!-- WORST: disables ATS entirely -->
  <key>NSAllowsArbitraryLoads</key>
  <true/>

  <!-- BAD: specific domain exceptions -->
  <key>NSExceptionDomains</key>
  <dict>
    <key>insecure-api.target.com</key>
    <dict>
      <key>NSExceptionAllowsInsecureHTTPLoads</key>
      <true/>
      <key>NSExceptionMinimumTLSVersion</key>
      <string>TLSv1.0</string>
    </dict>
  </dict>
</dict>

---

9. IOS PENTESTING DECISION TREE

Testing iOS application
│
├── Device jailbroken?
│   ├── Yes → full testing capability
│   │   ├── Keychain dump → ios keychain dump (§2)
│   │   ├── Filesystem inspection → check all data storage (§7)
│   │   ├── Runtime hooks → Frida/Objection (§5)
│   │   └── Binary analysis → class-dump decrypted binary (§6)
│   └── No → limited testing
│       ├── Re-sign with Frida gadget for runtime access
│       ├── Backup extraction for data analysis
│       └── Network-level testing (proxy + SSL bypass)
│
├── SSL pinning blocking proxy?
│   └── Yes → see mobile-ssl-pinning-bypass SKILL.md
│
├── URL schemes registered?
│   ├── OAuth callback via URL scheme? → hijacking risk (§3.2)
│   ├── Universal Links configured? → check AASA (§4.1)
│   └── Scheme used for sensitive actions? → test interception
│
├── Binary protections adequate?
│   ├── Missing PIE? → ASLR disabled (§6.1)
│   ├── No stack canaries? → overflow risk (§6.1)
│   └── Still encrypted? → decrypt first (§6.2)
│
├── Data storage secure?
│   ├── Tokens in NSUserDefaults? → plaintext extraction (§7.1)
│   ├── Keychain protection class? → AfterFirstUnlock = risky (§2.1)
│   ├── Screenshots captured? → check Snapshots dir (§7.1)
│   └── Keyboard cache? → check for sensitive autocomplete (§7.1)
│
├── ATS configured?
│   ├── ArbitraryLoads = true? → HTTP downgrade possible (§8)
│   └── Domain exceptions? → targeted HTTP interception
│
└── Runtime manipulation needed?
    ├── Jailbreak detection blocking? → ios jailbreak disable (§5.2)
    ├── Need to bypass auth check? → hook + modify return (§5.1)
    └── Need to trace API calls? → method hooking (§5.2)

iOS Runtime Tricks — Frida Recipes, Objection Reference & Hooking Patterns

AI LOAD INSTRUCTION: Load this when you need Frida recipes for iOS-specific hooks, Objection command reference, or runtime hooking pattern templates. Assumes the main SKILL.md is already loaded for general iOS testing methodology.

---

1. FRIDA RECIPES FOR iOS

1.1 ObjC Class Enumeration

// List all classes containing a keyword
Java.perform || true;  // NOP for iOS
ObjC.enumerateLoadedClasses({
    onMatch: function(name) {
        if (name.toLowerCase().indexOf('auth') !== -1 ||
            name.toLowerCase().indexOf('login') !== -1 ||
            name.toLowerCase().indexOf('token') !== -1) {
            console.log('[Class] ' + name);
        }
    },
    onComplete: function() { console.log('[+] Class enumeration done'); }
});

1.2 Method Enumeration for a Class

// List all methods of a specific class
var className = 'AppDelegate';
var methods = ObjC.classes[className].$ownMethods;
console.log('[' + className + '] Methods (' + methods.length + '):');
methods.forEach(function(method) {
    console.log('  ' + method);
});

1.3 Jailbreak Detection Bypass

// Comprehensive jailbreak detection bypass for iOS
var paths = [
    '/Applications/Cydia.app', '/usr/sbin/sshd', '/bin/bash',
    '/usr/bin/ssh', '/etc/apt', '/private/var/lib/apt/',
    '/usr/local/bin/cycript', '/usr/lib/libcycript.dylib',
    '/var/lib/cydia', '/var/cache/apt', '/var/lib/apt',
    '/Library/MobileSubstrate/MobileSubstrate.dylib',
    '/private/var/stash', '/.cydia_no_stash',
    '/Applications/Sileo.app', '/var/jb'
];

// Hook NSFileManager
var fm = ObjC.classes.NSFileManager;
Interceptor.attach(fm['- fileExistsAtPath:'].implementation, {
    onEnter: function(args) {
        this.path = ObjC.Object(args[2]).toString();
    },
    onLeave: function(retval) {
        for (var i = 0; i < paths.length; i++) {
            if (this.path === paths[i]) {
                retval.replace(ptr(0));
                console.log('[JB Bypass] fileExistsAtPath blocked: ' + this.path);
                return;
            }
        }
    }
});

// Hook canOpenURL (Cydia URL scheme check)
var app = ObjC.classes.UIApplication;
Interceptor.attach(app['- canOpenURL:'].implementation, {
    onEnter: function(args) {
        this.url = ObjC.Object(args[2]).toString();
    },
    onLeave: function(retval) {
        if (this.url.indexOf('cydia://') !== -1 ||
            this.url.indexOf('sileo://') !== -1) {
            retval.replace(ptr(0));
            console.log('[JB Bypass] canOpenURL blocked: ' + this.url);
        }
    }
});

// Hook fopen for /etc/fstab, /bin/sh checks
var fopen = Module.findExportByName(null, 'fopen');
Interceptor.attach(fopen, {
    onEnter: function(args) {
        this.path = args[0].readUtf8String();
    },
    onLeave: function(retval) {
        if (this.path === '/bin/sh' || this.path === '/etc/fstab' ||
            this.path === '/bin/bash') {
            retval.replace(ptr(0));
        }
    }
});

// Hook fork() — should return -1 on non-jailbroken
var fork = Module.findExportByName(null, 'fork');
Interceptor.attach(fork, {
    onLeave: function(retval) {
        retval.replace(ptr(-1));
        console.log('[JB Bypass] fork() → -1');
    }
});

console.log('[+] Jailbreak detection bypass installed');

1.4 SSL Pinning Bypass (iOS-Specific)

// Hook SecTrustEvaluateWithError (iOS 12+)
var SecTrustEvaluateWithError = Module.findExportByName('Security', 'SecTrustEvaluateWithError');
if (SecTrustEvaluateWithError) {
    Interceptor.attach(SecTrustEvaluateWithError, {
        onLeave: function(retval) {
            retval.replace(ptr(1));  // Return true (trusted)
        }
    });
}

// Hook SecTrustEvaluate (legacy)
var SecTrustEvaluate = Module.findExportByName('Security', 'SecTrustEvaluate');
if (SecTrustEvaluate) {
    Interceptor.attach(SecTrustEvaluate, {
        onLeave: function(retval) {
            retval.replace(ptr(0));  // errSecSuccess
        }
    });
}

// Hook NSURLSession delegate for certificate validation
var NSURLSession = ObjC.classes.NSURLSession;
if (NSURLSession) {
    try {
        var handler = ObjC.classes.NSURLSessionConfiguration;
        // Hook didReceiveChallenge completionHandler
        Interceptor.attach(
            ObjC.classes.__NSCFURLSessionConnection['- _]redirectRequest:withResponse:completionHandler:'].implementation, {
            onEnter: function(args) {
                console.log('[SSL] Redirect intercepted');
            }
        });
    } catch(e) {}
}

console.log('[+] iOS SSL pinning bypass installed');

1.5 Keychain Dumper via Frida

// Dump all keychain items accessible to the app
function dumpKeychain() {
    var NSMutableDictionary = ObjC.classes.NSMutableDictionary;
    var SecItemCopyMatching = new NativeFunction(
        Module.findExportByName('Security', 'SecItemCopyMatching'),
        'int', ['pointer', 'pointer']
    );

    var classes = [
        'genp',  // kSecClassGenericPassword
        'inet',  // kSecClassInternetPassword
        'cert',  // kSecClassCertificate
        'keys'   // kSecClassKey
    ];

    classes.forEach(function(secClass) {
        var query = NSMutableDictionary.alloc().init();
        query.setObject_forKey_(secClass, 'class');
        query.setObject_forKey_(ObjC.classes.__NSCFBoolean.numberWithBool_(true), 'r_Data');
        query.setObject_forKey_('m_LimitAll', 'm_Limit');

        var result = Memory.alloc(Process.pointerSize);
        var status = SecItemCopyMatching(query.handle, result);

        if (status === 0) {
            var items = new ObjC.Object(result.readPointer());
            console.log('\n[Keychain] Class: ' + secClass + ' (' + items.count() + ' items)');

            for (var i = 0; i < items.count(); i++) {
                var item = items.objectAtIndex_(i);
                console.log('  Account: ' + item.objectForKey_('acct'));
                console.log('  Service: ' + item.objectForKey_('svce'));
                var data = item.objectForKey_('v_Data');
                if (data) {
                    try {
                        var str = ObjC.classes.NSString.alloc().initWithData_encoding_(data, 4);
                        console.log('  Data: ' + str);
                    } catch(e) {
                        console.log('  Data: <binary ' + data.length() + ' bytes>');
                    }
                }
                console.log('  ---');
            }
        }
    });
}

dumpKeychain();

---

2. OBJECTION COMMAND REFERENCE FOR iOS

2.1 Information Gathering

2.2 Security Bypass

2.3 Data Extraction

2.4 Runtime Manipulation

2.5 Filesystem

---

3. RUNTIME HOOKING PATTERNS

3.1 Return Value Modification

// Force any boolean method to return true/false
function hookBoolMethod(className, methodName, returnValue) {
    var hook = ObjC.classes[className][methodName];
    Interceptor.attach(hook.implementation, {
        onLeave: function(retval) {
            var newVal = returnValue ? ptr(1) : ptr(0);
            retval.replace(newVal);
            console.log('[Hook] ' + className + ' ' + methodName + ' → ' + returnValue);
        }
    });
}

// Examples
hookBoolMethod('SecurityManager', '- isJailbroken', false);
hookBoolMethod('AuthController', '- isSessionValid', true);
hookBoolMethod('AppDelegate', '- shouldEnforceSSLPinning', false);

3.2 Argument Logging and Modification

// Log and optionally modify method arguments
var target = ObjC.classes.APIClient['- sendRequest:withToken:'];
Interceptor.attach(target.implementation, {
    onEnter: function(args) {
        // args[0] = self, args[1] = _cmd, args[2+] = method args
        var request = ObjC.Object(args[2]);
        var token = ObjC.Object(args[3]);
        console.log('[API] Request: ' + request.toString());
        console.log('[API] Token: ' + token.toString());

        // Modify argument: replace token
        var newToken = ObjC.classes.NSString.stringWithString_('attacker_token');
        args[3] = newToken.handle;
    },
    onLeave: function(retval) {
        console.log('[API] Response: ' + ObjC.Object(retval).toString());
    }
});

3.3 Method Swizzling via Frida

// Replace method implementation entirely
var originalImpl = ObjC.classes.PaymentManager['- validateReceipt:'].implementation;

ObjC.classes.PaymentManager['- validateReceipt:'].implementation = ObjC.implement(
    ObjC.classes.PaymentManager['- validateReceipt:'], function(handle, selector, receipt) {
        console.log('[Swizzle] validateReceipt called');
        // Skip validation, return success
        return ptr(1);
    }
);

3.4 Notification Observer

// Monitor NSNotificationCenter for interesting events
var nc = ObjC.classes.NSNotificationCenter;
Interceptor.attach(nc['- postNotificationName:object:userInfo:'].implementation, {
    onEnter: function(args) {
        var name = ObjC.Object(args[2]).toString();
        var userInfo = args[4].isNull() ? 'nil' : ObjC.Object(args[4]).toString();
        if (name.indexOf('auth') !== -1 || name.indexOf('login') !== -1 ||
            name.indexOf('token') !== -1 || name.indexOf('session') !== -1) {
            console.log('[Notification] ' + name);
            console.log('[Notification] userInfo: ' + userInfo);
        }
    }
});

---

4. COMMON iOS TESTING WORKFLOWS

4.1 Quick Security Audit Flow

# Step 1: Get decrypted binary
frida-ios-dump com.target.app   # or bagbak

# Step 2: Static analysis
class-dump decrypted_binary > headers.h
grep -r "password\|secret\|token\|apikey\|isJailbroken" headers.h

# Step 3: Check binary protections
otool -hv decrypted_binary | grep PIE
otool -Iv decrypted_binary | grep -c __stack_chk_guard

# Step 4: Runtime testing with Objection
objection -g com.target.app explore
> ios keychain dump
> ios nsuserdefaults get
> ios sslpinning disable
> ios jailbreak disable

# Step 5: Traffic interception
# Configure proxy (Burp/mitmproxy) + SSL bypass
# Analyze API calls for auth issues, IDOR, etc.

4.2 Data Extraction Workflow

# 1. Connect to app
objection -g com.target.app explore

# 2. Enumerate data stores
> env   # shows sandbox paths
> ls Documents/
> ls Library/
> ls Library/Preferences/
> ls Library/Application Support/

# 3. Download interesting files
> file download Library/Preferences/com.target.app.plist
> file download Library/Application\ Support/data.sqlite

# 4. Dump keychain
> ios keychain dump --json > keychain.json

# 5. Check cookies
> ios cookies get

# 6. Monitor pasteboard
> ios pasteboard monitor

---

5. iOS-SPECIFIC FRIDA QUICK REFERENCE