iOS Application Penetration Testing

Welcome to our comprehensive guide on iOS App Penetration Testing. In this, we explore the essential techniques, tools, and methodologies used to identify vulnerabilities in iOS Application

Prerequisites

• Mac device/Linux

• iPhone (jailbroken)/iOS Simulators

• Mobexler

What is Jailbreaking in iOS?

Jailbreaking an iOS device gives testers elevated privileges and access to system files, allowing for in-depth security assessments. It makes it possible to install extra tools, change settings, and look into sensitive information. By bypassing iOS restrictions, jailbreaking provides root access and the ability to install apps that aren’t officially approved.

iOS Version Range	Jailbreak Tool
iOS 11–13.x	Checkra1n
iOS 12–14.x	unc0ver
iOS 14–15.x	Taurine, Odyssey
iOS 15–16.x	Palera1n (for checkm8 devices), Dopamine

Types of Jailbreak

• Tethered - Requires the device to be connected to a computer every time it boots

• Untethered - A jailbreak that stays after reboots without external tools

• Semi-Tethered - Device reboots without a computer, but jailbreak features need reactivation

• Semi Untethered - The device can boot normally, but needs re-jailbreak (via an app) to regain access

Fun Facts about iOS Applications

• iOS Applications are installed as a Sandbox

• We can not install unauthorized applications outside of the app store/test-flight

• iOS applications have the extension of .ipa

Cydia/Sileo

Cydia/Sileo is a third-party application installer similar to the App Store and developed for jailbroken iOS Devices. Most of the jailbreaks install cydia/sileo during jailbreaking in the device.

Packages for Cydia/Sileo

• Frida - https://build.frida.re

• OpenSSH - http://apt.saurik.com/

• Filza - https://tigisoftware.com/cydia/

• AppSync Unified (for installing ad-hoc signed or unsigned applications) - https://cydia.akemi.ai/

• Plutil - https://apt.bingner.com/

• LibertyLite (Jailbreak Bypass) - https://ryleyangus.com/repo/

• ABypass(Jailbreak Bypass) - https://repo.co.kr/

• SSL Kill Switch(SSL Pinning Bypass) - https://julioverne.github.io/

Test Cases

Static Analysis

• Static Analysis with MobSF

• Check jailbreak detection bypass(RootClock, Objection, Frida Scripts)

• Check for SSL pinning bypass(SSLUnpinning 2.0, Objection, Frida Scripts)

• Check for Biometric bypass(Objection)

• Check for sensitive data exposure in local storage

• Check for sensitive data in keychains (Objection)

• Check for sensitive data in UserDefaults (Objection)

• Check for sensitive data leakage in logs( Apple Configurator 2 in Mac, Xcode in Mac, iTools in Windows, iOSLogInfo on iOS)

• Check for Minimum Device Access Policy

• Check for sensitive data in memory(Fridump)

• Check for side channel data Leakage (Screenshot, PasteBoard)

Dynamic Analysis

• Check for authentication bypass

• Check for IDOR, privilege escalation

• Check for business logic issues

• Check for WebView vulnerabilities

• Check for Command Injection

• Guessable/Weak/Default Credentials

• Authentication Bypass using attacks such as Injection Attacks

Vulnerable IPA

• Damn Vulnerable iOS App (DVIA)

• iGoat iOS