iOS pentesting playbook. Use when testing iOS applications for keychain extraction, URL scheme hijacking, Universal Links exploitation, runtime manipulation, binary protection analysis, data storage issues, and transport security bypass during authorized mobile security assessments.

SKILL: iOS Pentesting Tricks — Expert Attack Playbook AI LOAD INSTRUCTION : Expert iOS application security testing techniques. Covers jailbreak vs non jailbreak methodology, keychain extraction, URL scheme/Universal Links abuse, Frida/Objection runtime hooks, binary protection checks, and data storage analysis. Base models miss protection class nuances and AASA misconfiguration patterns. 0. RELATED ROUTING Before going deep, consider loading: [mobile ssl pinning bypass](../mobile ssl pinning bypass/SKILL.md) for in depth SSL pinning bypass (SecTrust hooks, SSL Kill Switch, framework specific techniques) [android pentesting tricks](../android pentesting tricks/SKILL.md) when also testing the Android version of the same app [api sec](../api sec/SKILL.md) for backend API security testing once traffic is intercepted Advanced Reference Also load [IOS RUNTIME TRICKS.md](./IOS RUNTIME TRICKS.md) when you need: Frida recipes for iOS specific hooks (ObjC class enumeration, method swizzling) Objection command reference for iOS Runtime hooking patterns and bypass templates 1. JAILBREAK VS NON JAILBREAK TESTING Capability Jailbroken Non Jailbroken SSL pinning bypass Frida, SSL Kill Switch 2, Objection Network debugging proxy, MITM profiles (limited) Keychain access keychain dumper, Frida dump Only via backup extraction (limited) Filesystem inspection Full access to app sandbox Only via ideviceinstaller + backup Runtime manipulation Frida, Cycript, LLDB attach Frida on sideloaded apps (re signed) Binary analysis Class dump, Hopper on device Decrypt IPA on Mac, analyze offline Method hooking Full Frida/Cycript capability Limited (needs re signed app + Frida gadget) Non Jailbreak Testing Setup 2. KEYCHAIN EXTRACTION 2.1 Keychain Protection Classes Protection Class Availability Use Case Risk Level kSecAttrAccessibleWhenUnlocked Only when device unlocked Passwords, tokens Medium kSecAttrAccessibleAfterFirstUnlock After first unlock until reboot Background tokens High (persists across locks) kSecAttrAccessibleAlways Always (deprecated iOS 12+) Legacy apps Critical kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly Passcode set + unlocked High value secrets Low 2.2 Extraction Methods 2.3 What to Look For Item Type Keychain Class Typical Content kSecClassGenericPassword genp App tokens, API keys, user credentials kSecClassInternetPassword inet HTTP auth credentials, OAuth tokens kSecClassCertificate cert Client certificates kSecClassIdentity idnt Cert + private key pair kSecClassKey keys Encryption keys 3. URL SCHEME HIJACKING 3.1 Custom URL Scheme Discovery 3.2 Hijacking Attack Attack Vector Technique Impact OAuth callback interception Register same scheme Steal authorization codes Deep link hijacking Register same scheme Phishing, data interception Payment callback interception Register payment scheme Transaction manipulation 3.3 URL Scheme vs Universal Links Security Feature Custom URL Scheme Universal Links Registration Any app can claim any scheme Requires AASA file on domain Uniqueness Not guaranteed (multiple apps) One app per domain path Validation None Cryptographic (AASA signed) Recommended for Non sensitive navigation OAuth callbacks, sensitive actions Hijackable Yes (duplicate registration) Only via AASA misconfiguration 4. UNIVERSAL LINKS EXPLOITATION 4.1 AASA (Apple App Site Association) Misconfiguration Misconfiguration Risk Exploitation Wildcard paths ( ) App claims all URLs on domain Redirect chain may break UL → fallback to URL scheme Missing AASA file Universal Links won't work App falls back to less secure URL scheme AASA on wrong domain Links not associated Scheme hijacking possible AASA not served as application/json Parsing failure Links won't associate CDN caching stale AASA Outdated associations Inconsistent behavior 4.2 Breaking Universal Links → URL Scheme Fallback 5. RUNTIME MANIPULATION 5.1 Frida on iOS 5.2 Objection iOS Commands 5.3 Cycript (Legacy but Useful) 6. BINARY PROTECTIONS 6.1 Checking Binary Security Protection Check Missing Impact PIE MH PIE flag in header ASLR disabled → predictable addresses ARC objc release symbol Use after free more likely Stack Canaries stack chk guard Buffer overflow exploitation easier Encryption cryptid value Binary readable without decryption 6.2 Decrypting IPA 6.3 Class dump for ObjC Analysis 7. DATA STORAGE ISSUES 7.1 Sensitive Data Locations Location Path What to Check NSUserDefaults Library/Preferences/<bundle id .plist Tokens, user data, feature flags Core Data (SQLite) Library/Application Support/ .sqlite Cached API responses, user records Keychain System keychain database Credentials, keys (check protection class) Cookies Library/Cookies/Cookies.binarycookies Session cookies Cache Library/Caches/ Cached API responses, images with PII Screenshots Library/SplashBoard/Snapshots/ App state captured on background Keyboard cache Library/Keyboard/ Autocomplete entries with sensitive input Pasteboard System pasteboard Copied passwords, tokens WebView storage Library/WebKit/WebsiteData/ LocalStorage, IndexedDB, cookies 7.2 Inspection Commands 8. TRANSPORT SECURITY (ATS) 8.1 ATS Exception Patterns ATS Setting Risk Notes NSAllowsArbitraryLoads = true Critical All HTTP allowed NSExceptionAllowsInsecureHTTPLoads High HTTP for specific domain NSExceptionMinimumTLSVersion = TLSv1.0 Medium Weak TLS NSAllowsArbitraryLoadsInWebContent Medium WebView can load HTTP No ATS exceptions Low Proper configuration 9. IOS PENTESTING DECISION TREE

ios-pentesting-tricks