# IOS Pentesting Basics

> iOS security testing operations including device identification, shell access, data transfer, app extraction, and decryption. Use this skill whenever the user needs to perform iOS pentesting tasks, identify iOS devices, access device shells, transfer data from iOS devices, extract or decrypt iOS apps, or install apps on iOS devices. Trigger for any iOS security assessment, mobile app testing, or iOS device forensics work.

- Skill: `abelrguezr/ios-pentesting-basics-2` (Agent Skill, multi-file: 5 files)
- Install (CLI): `npx skillmds@latest add abelrguezr/ios-pentesting-basics-2`
- Raw SKILL.md: https://api.skillmd.com/api/skills/abelrguezr/ios-pentesting-basics-2/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: abelrguezr (https://skillmd.com/u/abelrguezr)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/abelrguezr/ios-pentesting-basics-2

---


# iOS Basic Testing Operations

A skill for performing iOS security testing operations including device identification, shell access, data transfer, and app extraction/decryption.

## Device Identification

### Finding the UDID

The UDID (40-digit unique identifier) is essential for iOS device operations.

**Via Finder (macOS Catalina+):**
1. Connect device via USB
2. Open Finder and select the device
3. Click the device name to reveal details including UDID

**Via iTunes (macOS pre-Catalina):**
- Connect device and view in iTunes to find UDID

**Command-line methods:**

```bash
# Using ioreg
ioreg -p IOUSB -l | grep "USB Serial"

# Using ideviceinstaller (macOS/Linux)
brew install ideviceinstaller
idevice_id -l

# Using system_profiler
system_profiler SPUSBDataType | sed -n -e '/iPad/,/Serial/p;/iPhone/,/Serial/p;/iPod/,/Serial/p' | grep "Serial Number:"

# Using instruments
instruments -s devices
```

## Device Shell Access

### SSH Access (Post-Jailbreak)

1. Install OpenSSH package on jailbroken device
2. Connect via SSH:
   ```bash
   ssh root@<device_ip_address>
   ```
3. **Important:** Change default passwords (`alpine` for root and mobile users)

### SSH Over USB (No Wi-Fi)

Use `iproxy` to map device ports:

```bash
# Forward device port 22 to local port 2222
iproxy 2222 22

# Connect via SSH
ssh -p 2222 root@localhost
```

### On-Device Shell Apps

- **NewTerm 2**: Direct device interaction for troubleshooting
- **Reverse SSH shells**: Establish remote access from host computer

### Password Reset

To reset forgotten passwords to default (`alpine`):

1. Edit `/private/etc/master.passwd`
2. Replace existing hash with `alpine` hash for root and mobile users

## Data Transfer

### Archive and Transfer via SSH/SCP

```bash
# On device: Archive application data
tar czvf /tmp/data.tgz /private/var/mobile/Containers/Data/Application/<APP_UUID>

# Exit SSH
exit

# On host: Pull the archive
scp -P 2222 root@localhost:/tmp/data.tgz .
```

### GUI Tools

- **iFunbox** and **iExplorer**: File management on iOS devices
- **Note**: iOS 8.4+ restricts access to app sandbox unless jailbroken

### Objection for File Management

```bash
# Launch objection explorer
objection --gadget com.apple.mobilesafari explorer

# Navigate to app documents
cd /var/mobile/Containers/Data/Application/<APP_UUID>/Documents

# Download files
file download <filename>
```

## App Extraction and Decryption

### Acquiring IPA Files

**OTA Distribution:**

```bash
# Install ITMS services downloader
npm install -g itms-services

# Download IPA from manifest
itms-services -u "itms-services://?action=download-manifest&url=<MANIFEST_URL>" -o - > out.ipa
```

### Manual Decryption Process

iOS apps are encrypted with FairPlay. To decrypt:

1. **Check and modify PIE flag:**
   ```bash
   otool -Vh Original_App
   python change_macho_flags.py --no-pie Original_App
   otool -Vh Hello_World
   ```

2. **Identify encrypted section:**
   ```bash
   otool -l Original_App | grep -A 4 LC_ENCRYPTION_INFO
   ```

3. **Dump memory from jailbroken device:**
   ```bash
   # Using gdb
dump memory dump.bin 0x8000 0x10a4000
   ```

4. **Overwrite encrypted section:**
   ```bash
   dd bs=1 seek=<starting_address> conv=notrunc if=dump.bin of=Original_App
   ```

5. **Finalize:** Set `cryptid` to 0 using MachOView

### Automated Decryption Tools

#### frida-ios-dump

```bash
# List installed apps
python dump.py -l

# Dump specific app
python3 dump.py -u "root" -p "<PASSWORD>" <BUNDLE_ID>
```

**Configuration:**
- Connect via localhost:2222 (iproxy) or direct IP:port
- Requires jailbroken device with frida-server

#### frida-ipa-extract

```bash
# Setup
python3 -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt

# USB mode
python extract.py -U -f com.example.app -o MyApp.ipa

# SSH mode
python extract.py -H 192.168.100.32 -P 2222 -u root -p password -f com.example.app

# With sandbox dump
python extract.py -U -f com.example.app -o MyApp.ipa --sandbox --no-resume
```

**Flags:**
- `-f <bundle>`: Spawn/attach to bundle ID
- `-o`: Output filename
- `-U`: USB mode
- `-H/-P/-u/-p`: SSH tunnel parameters
- `--sandbox`: Dump sandbox
- `--no-resume`: Keep app suspended

#### flexdecrypt/flexdump

```bash
# Install on device
apt install zip unzip
wget https://gist.githubusercontent.com/defparam/71d67ee738341559c35c684d659d40ac/raw/30c7612262f1faf7871ba8e32fbe29c0f3ef9e27/flexdump -P /usr/local/bin
chmod +x /usr/local/bin/flexdump

# List and dump apps
flexdump list
flexdump dump Twitter.app
```

#### bagbak

```bash
bagbak --raw Chrome
```

#### r2flutch

Radare2 + Frida based decryption tool.

## App Installation

### Sideloading Methods

**Cydia Impactor:**
- Sign and install IPA files on iOS
- Also supports APK on Android

**libimobiledevice:**
```bash
# Install via ideviceinstaller
ideviceinstaller -i app.ipa
```

**ipainstaller:**
- Command-line installation tool

**ios-deploy (macOS):**
```bash
# Install and launch
ios-deploy --bundle app.ipa --launch
```

**Xcode:**
1. Window → Devices and Simulators
2. Add app to Installed Apps

### Installing iPad Apps on iPhone

Modify `Info.plist`:
1. Change `UIDeviceFamily` value to `1`
2. Re-sign the IPA (signature validation required)

**Note:** May fail if app requires iPad-exclusive capabilities.

## Common Workflows

### Full App Extraction Workflow

1. Identify device UDID
2. Establish SSH connection (via Wi-Fi or iproxy)
3. List installed apps
4. Extract app using preferred tool (frida-ios-dump, flexdump, etc.)
5. Decrypt if necessary
6. Transfer to host machine

### Data Exfiltration Workflow

1. Connect to device shell
2. Locate app data directory
3. Archive with tar
4. Transfer via SCP or objection

## Security Considerations

- Always change default passwords after jailbreak
- Use SSH over USB when Wi-Fi is unavailable
- Be aware of iOS version restrictions on tools
- Some tools require specific jailbreak levels

## References

- [OWASP MASTG iOS Security Testing](https://mas.owasp.org/MASTG/iOS/0x06b-iOS-Security-Testing/)
- [frida-ios-dump](https://github.com/AloneMonkey/frida-ios-dump)
- [frida-ipa-extract](https://github.com/lautarovculic/frida-ipa-extract)
- [flexdecrypt](https://github.com/JohnCoates/flexdecrypt)
- [bagbak](https://github.com/ChiChou/bagbak)
- [r2flutch](https://github.com/as0ler/r2flutch)
- [ios-deploy](https://github.com/ios-control/ios-deploy)