Hacking and Pentesting iOS Applications

Explore fundamentals of iOS applications, including development basics, programming languages, building a Hello World in Xcode with Objective-C, and examining IPA file structure and app directory on a device.

Learn iOS app basics, including Objective-C and Swift, and explore how Xcode, IPA files, App Stores, and Cydia fit into pentesting Objective-C based apps.

Build an iOS app in Xcode with Objective-C using a storyboard to print hello world directly. Use a real device with a provisioning profile for pen testing beyond the simulator.

Set up an effective iOS pentesting lab by understanding the need, prerequisites, and common challenges, then compare jailbroken and non-jailbroken device setups.

Understand why a dedicated pen testing lab is essential to run and debug iOS apps for runtime analysis, including jailbroken vs non-jailbroken setups and Frida patching.

Set up a pentesting lab on a jailbroken iPhone by installing openssh, frida server, and objection through cydia, configuring repos, and verifying ssh, frida client, and objection connectivity.

Install and sign two vulnerable iOS apps on a jailbroken device using provisioning profiles and Apple Sign, then explore basic vulnerabilities and lab setup techniques for testing.

Learn to set up a lab on a non jailbroken iPhone by injecting a Frida dylib, patching an IPA with objection, and signing with Apple sign and a provisioning profile.

Embed the Frida gadget into the app payload and deploy with iOS deploy to debug on a non-jailbroken device; trust the developer certificate and attach Frida to inspect the app.

Learn how to sign an unsigned iOS app and install it on a non-jailbroken device using a provisioning profile and Apple signing tools, including Xcode and command-line signing.

Explore the October update on re-verification of installation methods for iOS applications in hacking and pentesting, focusing on validating attack surfaces and installation integrity.

Explore iOS pentesting basics, analyze traffic, understand secure data storage, and identify server-side and client-side vulnerabilities in the secure store app using v1 ipa on jailbroken and non-jailbroken devices.

Develop a practical approach to iOS application pentesting, recognizing that vulnerabilities vary by app and functionality. Focus on traffic analysis, client-side bypasses, and runtime analysis to begin bug bounty testing.

Analyze iOS traffic by intercepting http and https with Burp Suite. Install Burp's root CA to intercept https traffic and configure the app and server IP for testing.

examine insecure local data storage vulnerabilities by accessing client-side data on jailbroken and non-jailbroken devices, uncovering clear-text bank details and authentication tokens in plist, sqlite databases, and other local stores.

Learn how to explore an app's local data storage on non-jailbroken iOS devices using objection, view bundle and document directories, and inspect SQLite databases.

Learn how iOS keychain stores sensitive data and how a tool like Keychain Dumper can reveal secrets, including wifi passwords, with attributes such as accessible after first unlock.

Identify server-side vulnerabilities in mobile apps by examining backend REST APIs. Explore issues like SQL injection, XXY, rate limiting, brute forcing, hidden APIs, and unintended data exposure.

Intercept login requests to reveal credentials in logs, expose cleartext passwords via backend responses, and demonstrate SQL injection that allows unauthorized access to user data.

Explore client side vulnerabilities in iOS apps, including authorization bypass via insecure data storage, sensitive data logging, man-in-the-middle risks, script injection, and pasteboard access.

Demonstrate bypassing login through client-side logic and escalating privileges by altering local storage and authentication tokens using the md5 hash of a different username, objection, and frida.

Explore how application logs can expose sensitive data, as passwords are logged to device console during testing. Learn to identify and prevent insecure logging in production apps, a client-side vulnerability.

Explore how sensitive data can be stored in the iOS pasteboard and copied from apps. Practice testing with objection to monitor pasteboard contents on jailbroken and non-jailbroken devices.

Explore how a webview-based iOS app's secure store page can suffer client-side injection via man-in-the-middle tampering of remote HTML, enabling JavaScript execution and phishing credential theft.

Learn to bypass client-side restrictions in secure store v2 iOS apps using runtime manipulation, bypass jailbreak detection, handle end-to-end encryption and SSL pinning, and reverse engineer with Hopper disassembler.

Discover how to decrypt iOS applications from the App Store to enable static analysis by dumping class information, using Frida iOS Dump on iOS 12.4.

Explore secure store v2 features like jailbreak detection, ssl pinning, end-to-end encryption, and the two app flavors, and learn how to bypass protections to test iOS app security.

Download class dump, extract v1 and v2 binaries, and dump class information to perform static analysis and study isDeviceJailbroken for runtime analysis with Frida.

Learn to bypass jailbreak detection on the Secure Store V2 iOS app using Objection and early instrumentation, then explore Frida tracing and Hopper patching for deeper analysis.

This lecture shows how secure store v2 fixes local data storage by encrypting on-disk data, including tokens and bank details, while email remains unencrypted without the decryption key.

Configure the device proxy to intercept traffic for the secure store v2 app, observe SSL pinning errors on the about page, and inspect login and profile end-to-end token encryption.

Explore Frida for runtime tracing and manipulation of iOS Objective-C apps, using its read-eval-print loop to analyze feature invocation, class and method activity, arguments, and return values.

Use Frieda cli to connect to an ios application with the Frida client and Frida Dash U, unlock device, and inspect sign in view controller via the Objective-C runtime.

Learn how frida trace performs runtime tracing on iOS apps to reveal http requests, urls, methods, headers, and bodies by tracing NSUrlRequest and Objective-C methods.

Write Frida scripts to trace http calls in iOS applications, capturing the http body, URL, and headers for signup requests, and log return values with object-to-string conversion.

Explore how end to end encryption in mobile apps blocks pentest traffic and hides data. Discover methods like certificate handling, ssl pinning bypass, and runtime tracing to obtain keys.

Trace crypto calls in Secure Store V2 using Frida and Objection to reveal encryption keys, decrypt data, and perform server-side attacks via encrypted payloads despite end-to-end encryption.

Learn to use objection to hook iOS methods, monitor calls, and dump arguments, return values, and backtraces for practical iOS pentesting and key extraction.

Use objection to dump heap memory of an iOS app, export a memory dump, grep for sensitive strings like http URLs and passwords, and observe how decryption reveals text data.

Learn Hopper, a disassembler used for reversing and patching iOS binaries, and view ARM disassembly. Use features like string search, graph view, and hex view to support reverse engineering.

Patch jailbreak detection and SSL pinning in iOS apps using Hopper disassembler by patching the mach-o binary, resigning, and installing the bypassed app.

Explore how ssl pinning strengthens https connections by verifying the server certificate against a bundled certificate or a pinned public key, preventing man-in-the-middle interceptions with proxies like Burp.

Patch the iOS binary with Hopper to bypass SSL pinning and jailbreak detection, enabling interception of app traffic through a configured proxy.

Celebrate completing the course on hacking iOS applications and share the journey with friends and colleagues to help others join.