ios-pentesting-tricks
starsforks
How to install ios-pentesting-tricks?
prohao42/aimy-skill/ios-pentesting-tricks
$npx -y skills add Prohao42/aimy-skill --skill ios-pentesting-tricksiOS pentesting playbook. Use when testing iOS applications for keychain extraction, URL scheme hijacking, Universal Links exploitation, runtime manipulation, binary protection analysis, data storage issues, and transport security bypass during authorized mobile security assessmen
SKILL.md
| 1 | # SKILL: iOS Pentesting Tricks — Expert Attack Playbook |
| 2 | |
| 3 | > **AI LOAD INSTRUCTION**: Expert iOS application security testing techniques. Covers jailbreak vs non-jailbreak methodology, keychain extraction, URL scheme/Universal Links abuse, Frida/Objection runtime hooks, binary protection checks, and data storage analysis. Base models miss protection class nuances and AASA misconfiguration patterns. |
| 4 | |
| 5 | ## 0. RELATED ROUTING |
| 6 | |
| 7 | Before going deep, consider loading: |
| 8 | |
| 9 | - [mobile-ssl-pinning-bypass](../mobile-ssl-pinning-bypass/SKILL.md) for in-depth SSL pinning bypass (SecTrust hooks, SSL Kill Switch, framework-specific techniques) |
| 10 | - [android-pentesting-tricks](../android-pentesting-tricks/SKILL.md) when also testing the Android version of the same app |
| 11 | - [api-sec](../api-sec/SKILL.md) for backend API security testing once traffic is intercepted |
| 12 | |
| 13 | ### Advanced Reference |
| 14 | |
| 15 | Also load [IOS_RUNTIME_TRICKS.md](./IOS_RUNTIME_TRICKS.md) when you need: |
| 16 | - Frida recipes for iOS-specific hooks (ObjC class enumeration, method swizzling) |
| 17 | - Objection command reference for iOS |
| 18 | - Runtime hooking patterns and bypass templates |
| 19 | |
| 20 | --- |
| 21 | |
| 22 | ## 1. JAILBREAK VS NON-JAILBREAK TESTING |
| 23 | |
| 24 | | Capability | Jailbroken | Non-Jailbroken | |
| 25 | |---|---|---| |
| 26 | | SSL pinning bypass | Frida, SSL Kill Switch 2, Objection | Network debugging proxy, MITM profiles (limited) | |
| 27 | | Keychain access | keychain-dumper, Frida dump | Only via backup extraction (limited) | |
| 28 | | Filesystem inspection | Full access to app sandbox | Only via `ideviceinstaller` + backup | |
| 29 | | Runtime manipulation | Frida, Cycript, LLDB attach | Frida on sideloaded apps (re-signed) | |
| 30 | | Binary analysis | Class-dump, Hopper on-device | Decrypt IPA on Mac, analyze offline | |
| 31 | | Method hooking | Full Frida/Cycript capability | Limited (needs re-signed app + Frida gadget) | |
| 32 | |
| 33 | ### Non-Jailbreak Testing Setup |
| 34 | |
| 35 | ```bash |
| 36 | # Extract IPA from device |
| 37 | ideviceinstaller -l # List installed apps |
| 38 | ios-deploy --id <UDID> --download --bundle_id com.target.app |
| 39 | |
| 40 | # Or use frida-ios-dump for decrypted IPA (jailbroken) |
| 41 | python dump.py com.target.app |
| 42 | |
| 43 | # Sideload with Frida gadget (non-jailbreak runtime hooking) |
| 44 | # 1. Extract IPA, 2. Insert FridaGadget.dylib into Frameworks/ |
| 45 | # 3. Re-sign with valid profile, 4. Install via ios-deploy |
| 46 | ``` |
| 47 | |
| 48 | --- |
| 49 | |
| 50 | ## 2. KEYCHAIN EXTRACTION |
| 51 | |
| 52 | ### 2.1 Keychain Protection Classes |
| 53 | |
| 54 | | Protection Class | Availability | Use Case | Risk Level | |
| 55 | |---|---|---|---| |
| 56 | | `kSecAttrAccessibleWhenUnlocked` | Only when device unlocked | Passwords, tokens | Medium | |
| 57 | | `kSecAttrAccessibleAfterFirstUnlock` | After first unlock until reboot | Background tokens | High (persists across locks) | |
| 58 | | `kSecAttrAccessibleAlways` | Always (deprecated iOS 12+) | Legacy apps | Critical | |
| 59 | | `kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly` | Passcode set + unlocked | High-value secrets | Low | |
| 60 | |
| 61 | ### 2.2 Extraction Methods |
| 62 | |
| 63 | ```bash |
| 64 | # Jailbroken: keychain-dumper |
| 65 | /path/to/keychain-dumper -a # Dump all accessible items |
| 66 | /path/to/keychain-dumper -g password # Generic passwords only |
| 67 | /path/to/keychain-dumper -i # Internet passwords |
| 68 | |
| 69 | # Frida / Objection |
| 70 | objection -g com.target.app explore |
| 71 | > ios keychain dump |
| 72 | > ios keychain dump --json # JSON output for parsing |
| 73 | |
| 74 | # Frida script for keychain enumeration |
| 75 | frida -U -f com.target.app -l keychain_dump.js |
| 76 | ``` |
| 77 | |
| 78 | ### 2.3 What to Look For |
| 79 | |
| 80 | | Item Type | Keychain Class | Typical Content | |
| 81 | |---|---|---| |
| 82 | | `kSecClassGenericPassword` | `genp` | App tokens, API keys, user credentials | |
| 83 | | `kSecClassInternetPassword` | `inet` | HTTP auth credentials, OAuth tokens | |
| 84 | | `kSecClassCertificate` | `cert` | Client certificates | |
| 85 | | `kSecClassIdentity` | `idnt` | Cert + private key pair | |
| 86 | | `kSecClassKey` | `keys` | Encryption keys | |
| 87 | |
| 88 | --- |
| 89 | |
| 90 | ## 3. URL SCHEME HIJACKING |
| 91 | |
| 92 | ### 3.1 Custom URL Scheme Discovery |
| 93 | |
| 94 | ```bash |
| 95 | # From IPA/app bundle — check Info.plist |
| 96 | plutil -p /path/to/Payload/Target.app/Info.plist | grep -A 10 CFBundleURLTypes |
| 97 | |
| 98 | # Example output: |
| 99 | # "CFBundleURLSchemes" => ["targetapp", "fb123456789"] |
| 100 | ``` |
| 101 | |
| 102 | ### 3.2 Hijacking Attack |
| 103 | |
| 104 | ``` |
| 105 | Scenario: Target app registers "targetapp://" for OAuth callback |
| 106 | |
| 107 | 1. Attacker app also registers "targetapp://" URL scheme |
| 108 | 2. User initiates OAuth login in target app |
| 109 | 3. OAuth provider redirects to targetapp://callback?code=AUTH_CODE |
| 110 | 4. iOS may open attacker's app instead (non-deterministic scheme resolution) |
| 111 | 5. Attacker captures OAuth authorization code |
| 112 | ``` |
| 113 | |
| 114 | | Attack Vector | Technique | Impact | |
| 115 | |---|---|---| |
| 116 | | OAuth callback interception | Register same scheme | Steal authorization codes | |
| 117 | | Deep link hijacking | Register same scheme | Phishing, data interception | |
| 118 | | Payment callback interception | Register p |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
