ios-pentesting-tricks

An offensive-security playbook for authorized iOS application security assessments. It applies when testing iOS apps for keychain extraction, URL scheme hijacking, Universal Links exploitation, runtime manipulation, binary protection analysis, data storage issues, and transport security bypass. It routes to companion skills for SSL pinning bypass, Android testing of the same app, and backend API security once traffic is intercepted.

It contrasts jailbroken and non-jailbroken methodology in a capability table and shows a non-jailbreak setup using ideviceinstaller and ios-deploy to extract an IPA, frida-ios-dump for a decrypted IPA on jailbroken devices, and inserting a Frida gadget into a re-signed app for runtime hooking. Keychain coverage explains the protection classes (WhenUnlocked, AfterFirstUnlock, the deprecated Always, and WhenPasscodeSetThisDeviceOnly) and their risk levels, extraction with keychain-dumper, Objection's ios keychain dump, or Frida, and the keychain item classes worth harvesting such as generic and internet passwords, certificates, identities, and keys.

URL scheme hijacking is covered by discovering custom schemes in Info.plist CFBundleURLTypes and registering a duplicate scheme in a malicious app to intercept OAuth callbacks and deep links, with a comparison to the stronger Universal Links model. Universal Links exploitation focuses on AASA misconfiguration such as overly broad wildcard paths or missing files that force a fallback to the less secure scheme. Runtime manipulation uses Frida for ObjC class enumeration and Interceptor method hooks that alter return values, and Objection commands for keychain, cookies, pasteboard, jailbreak-detection and SSL-pinning bypass, and method hooking.