The complete iOS Pentesting & Bug Bounty Course

Set up the Mobexler environment for iOS pentesting by installing the mob file on VMware or VirtualBox, tuning RAM, and exploring bundled tools like burpsuite, grapefruit, and objection.

Learn to install macOS on a Windows machine by creating a VMware based macOS virtual machine, patching VMware with auto unlocker, and installing macOS 13 Ventura using the ISO.

Explore simulators that mimic an iOS device, creating an environment that replicates configurations and behavior, while noting they cannot access hardware features like face ID or touch ID.

Learn how jailbreaking uses privilege escalation and kernel patches to gain root access on iOS devices, and compare four types—untethered, third, semi third, and semi-untethered—and their practical steps.

Learn how to jailbreak an iOS device using the Paladin jailbreak, including setting up dfu mode, running the Paladin script, and installing tweaks with Substitute and Celio.

Learn how iOS applications are packaged as ipa bundles, with a name.app containing assets, frameworks, info.plist, and payload, and how code signatures and core data influence installation and testing.

discover how info.plist files store iOS app configuration in key value pairs, reveal permissions, url schemes, export and import declarations, app transport security, and how to spot misconfigurations for pentesting.

Understand udid, a 40-digit unique device identifier that identifies an iOS device and parallels a mac address. View udid in the iPhone about section or in Finder when connected.

Learn how to securely copy files from an iOS device to a PC using SCP over SSH, specifying port 22, root authentication, and verifying the password.txt file transfer.

Explore extracting and decrypting ipas within the complete iOS pentesting & bug bounty course, using frida iOS dump, frida setup, ssh over usb, and the dump script.

Learn to sideload iOS apps by manually signing and installing them with Altstore. The video covers two methods, including using Apple ID sign-in, seven-day expiry, and a three-app limit.

Learn how iOS data protection encrypts file contents with a file key in metadata, secured by a file system key derived from a hardware key and passcode.

Explore keychain as an encrypted container in a sandbox, protected by an iOS generated password derived from the user password and device uid via PBKDF2, with four access control flags.

Explore how iOS apps run in sandboxed containers and use purpose strings in Info.plist to justify permissions, then assess app capabilities like location, camera, and http access for security.

Learn how iOS app extensions let apps offer content and actions to other apps, enabling sharing notes from notes to messages through a shared resource and read and paste workflow.

Discover how iOS device management enables corporate control over devices through tamper-proof profiles and policies, tied to device IDs and encrypted by the MDM server.

Identify improper platform usage by examining how apps misuse platform permissions, such as camera usage and insecure HTTP loads, and recognize misused Touch ID or keychain.

Explore insecure data storage from OWASP Top Ten 2016, where usernames and passwords are stored in a local database or clear text on the device file system, risking attacker access.

Explore insecure communication and authentication in mobile apps, including HTTP use, outdated TLS, TLS pinning bypass, OTP leakage, privacy leaks, and weak password policies that enable unauthorized access.

Analyze insufficient cryptography by examining weak hashing algorithms like md5 and sha-1 in a vulnerable iOS app, and advocate for strong hashing and encryption practices.

Explore OWASP mobile risk categories M6 through M10, including secure authorization, access control, code tampering, reverse engineering, and extraneous functionality, with defenses like signature verification and code obfuscation.

Explore static and dynamic mobile app pentesting using Mob Chef (mobile security framework) to decompile, analyze info.plist, permissions, and insecure APIs, then generate automated reports with findings and PDFs.

Perform manual file system analysis to locate sensitive data in an iOS app's sandbox, identifying the 36-character UUID directories, plist storage, and data in user defaults.

Learn to view and analyze iOS app logs on macOS or Linux, and detect sensitive data leaks by grepping for CVV and PIN in a Zygote demo.

Discover how core data uses sqlite for persistent storage and how insecure storage can expose sensitive user information. Encrypt data before storing it with strong encryption.

Discover how developers store sensitive data in databases beyond SQLite, including Realm, Couchbase Lite, and other .db files, and learn to locate them in app sandboxes using find commands.

Investigate Firebase misconfigurations by testing Firebase Realtime databases; append /.json to a database URL to reveal publicly accessible data and insecure data storage (M2).

Learn how developers store sensitive data in iOS keychain, common mistakes that cause leaks, and how to use the iOS keychain dump via objection to reveal secrets.

Explore iOS pasteboard concepts, including system wide and deprecated custom pasteboards, and learn how insecure sharing can leak sensitive data between apps, with techniques to disable copying.

Explore how iOS web views load websites inside apps and how javascript vulnerabilities like cross-site scripting can be exploited across Uiwebview, Webview, and Safari View Controller.

Learn iOS hotpatching and force updating to remotely patch all installations without App Store resubmission, ensuring users run the latest version and meet minimum iOS requirements.

Test memory for sensitive data by dumping the application's memory with objection reader and strings memory, saving to strings.txt, and scanning for keywords like password and passwd using Free Dump.

Learn to locate insecure APIs and memory allocation functions in an app binary using a grep-based verification workflow, spotting MD5, SHA1, random, and malloc usage for reporting.

Perform dynamic analysis of iOS apps, and learn how jailbroken devices use tweaks, substitute, and third-party app stores like Cydia or Sileo to install and manage tweaks.

Install Frida by adding a repo in a third-party app store like Cleo, then search for Frida and install; confirm with button changing to modify and run Frida -- ui.

Learn how jailbreak detection works on iOS and how Frida can bypass it by hooking the app and altering the detection response; five bypass methods are explored.

Learn how the shadow jailbreak-detection bypass tweak works, install it, and configure global and per-app settings and hooks to bypass jailbreak detections.

Learn how to bypass jailbreak detection using Liberty Lite by installing it from a repository, enabling it, and validating that jailbreak detection is bypassed within apps.

learn how a bypass tool evades jailbreak detection on iOS 14 and later by installing from a source and enabling the bypass to demonstrate detection evasion.

Discover how objection, a runtime mobile exploration toolkit, enables iOS jailbreak detection bypass by hooking apps, running iOS jailbreak disable, and returning not jailbroken.

Explore bypassing jailbreak detection in iOS apps using a range of tweaks and scripts, and review resources to evaluate which approach best helps pentest targets.

Discover ssl pinning in iOS apps and bypass it with Frida, by hooking the ssl pinning script, intercepting requests with Burp Suite, and testing certificate and public key pinning.

bypass ssl pinning using objection, a frida-based toolkit, to hook iOS apps, intercept traffic with burp suite, and explore vulnerabilities through dynamic analysis.

Learn to bypass local authentication by spoofing touch ID and face ID on iOS apps using Frida and objection, covering setup, commands, and demo scenarios.

Perform a live attack on the 99 acres iOS app to demonstrate static and dynamic analysis, including jailbroken-device checks, secrets exposure, and rate-limiting vulnerabilities.

Master your pen testing with an iOS pentesting checklist covering OWASP 2016 vulnerabilities, static and dynamic tests, and iOS-specific issues like Info.plist permissions and keychain.

Explore an iOS pentesting mind map outlining static and dynamic analysis checks and tools to uncover vulnerabilities. It includes app ecosystem, sensitive strings, weak crypto, SSL pinning, and jailbreak detection.

Explore iOS pentesting templates in Nuclei to automate static analysis, assess app permissions, and detect keys, secrets, and protections like app transport security and custom URL schemes.

Explore iOS pentesting report templates for dangerous permissions, insecure APIs, hashing algorithms, jailbreak detection bypass, SSL pinning bypass, and Touch ID/Face ID bypass, with steps to reproduce and PoC.