iOS Penetration Testing Methodology

iOS Application Penetration Testing

iOS applications are distributed as IPA packages and generally require a macOS environment and tooling such as Xcode and Frida to test. This section covers building an iOS testing environment, extracting the application package, checking for debug symbols, and instrumenting apps on non-jailbroken devices.

Setup and Preparation

Testing iOS applications generally requires a macOS environment for Xcode and the associated command-line tooling, plus a way to obtain the application’s IPA package.

Install macOS on VMware

If you do not have Apple hardware, macOS can be run in a VMware virtual machine.

1
# Setting up macOS:
2
https://www.youtube.com/watch?v=g8iQMlMuegw
3
https://www.makeuseof.com/tag/macos-windows-10-virtual-machine/

Extract an IPA from the App Store

iMazing can download and export an installed app as an .ipa file.

1
https://imazing.com/
2

3
# Using iMazing
4
1. Open iMazing on your PC.
5
2. Plug in your iPhone or iPad.
6
3. Go to Apps -> Manage Apps -> Library.
7
4. Find the app you want to download and click the cloud icon next to it.
8
5. Once downloaded, right-click the app and choose "Export .IPA".

Static Analysis

Checking for Debug Symbols

Unzip the .ipa and run objdump against the main application executable to check for debug symbols.

1
https://www.virtuesecurity.com/kb/ios-frida-objection-pentesting-cheat-sheet/
2

3
# Looking for debug symbols
4
# Unzip the .ipa file and run objdump against the iOS main application (executable)
5
objdump --syms Example.app/Example

Runtime Analysis with Objection and Frida

Frida and Objection can instrument iOS apps, including on non-jailbroken devices after the IPA has been patched and re-signed.

Xcode iPhone Simulator

1
# List available simulators
2
xcrun simctl list                      # Look for the one that says "Booted"

Frida on Non-Jailbroken iOS Devices

1
https://medium.com/@codeWithAhmedAli/how-to-use-frida-on-non-jailbreak-ios-devices-ea8d89c07369
2

3
# 1. Install Python.
4
brew install python
5

6
# 2. Install Frida tools.
7
pip3 install frida-tools
8

9
# 3. Install the Xcode Command Line Tools.
10
xcode-select --install
11

12
# 4. Install Objection (a runtime mobile exploration toolkit).
13
pip3 install objection
14

15
# 5. Clone and build insert_dylib, which helps inject Frida into the app.
16
git clone https://github.com/Tyilo/insert_dylib
17
cd insert_dylib/
18
xcodebuild
19
cp build/Release/insert_dylib /usr/local/bin/insert_dylib   # Use your own user path
20

21
# 6. Place your .ipa file in a separate folder.
22

23
# 7. Obtain a signing identity to re-sign the IPA with Frida embedded.
24
security find-identity -p codesigning -v
25

26
# 8. Run any simple app on your device to generate an embedded.mobileprovision file,
27
#    which is needed for the re-signing process.
28

29
# 9. Patch the IPA using Objection (re-sign with Frida embedded).
30
objection patchipa --source TestApp.ipa --codesign-signature ABCDEFG
31
# Replace ABCDEFG with your signing identity key. If you hit issues, ensure these
32
# Python packages are installed:
33
pip3 install click
34
pip3 install black
35
pip3 install setuptools
36

37
# 10. Install applesign, which helps re-sign the IPA.
38
npm install -g applesign
39

40
# 11. Unzip the signed IPA.
41
unzip TestApp-frida-codesigned.ipa
42

43
# 12. Deploy the app to your device using ios-deploy (connect the device via USB).
44
ios-deploy --bundle Payload/TestApp.app -W -d