# IOS Pentesting Basics

> iOS security architecture and pentesting fundamentals. Use this skill whenever the user mentions iOS security, mobile app pentesting, iOS app analysis, Info.plist inspection, Keychain investigation, data protection classes, sandboxing, or anything related to iOS penetration testing. This skill provides the foundational knowledge needed to understand iOS security mechanisms and how to investigate them during security assessments.

- Skill: `abelrguezr/ios-pentesting-basics` (Agent Skill, multi-file: 6 files)
- Install (CLI): `npx skillmds@latest add abelrguezr/ios-pentesting-basics`
- Raw SKILL.md: https://api.skillmd.com/api/skills/abelrguezr/ios-pentesting-basics/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: abelrguezr (https://skillmd.com/u/abelrguezr)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/abelrguezr/ios-pentesting-basics

---


# iOS Pentesting Basics

This skill provides foundational knowledge for iOS security assessments. Use it to understand iOS security architecture, filesystem structure, data protection mechanisms, and app investigation techniques.

## iOS Filesystem Structure

When investigating an iOS device, know where to look:

| Path | Purpose |
|------|---------|
| `/Applications` | Native applications (e.g., `/Applications/Calculator.app`) |
| `/var/containers/Bundle/application/[uuid]` | Application bundles for installed apps |
| `/var/mobile/Containers/Data/Application/[uuid]` | Application data directories |
| `/System` | Core system files and libraries |
| `/Library` | System-wide resources and settings |
| `/private/var/mobile/Library/Logs/CrashReporter/` | Crash logs for applications |
| `/dev` | Device files |
| `/Core` | OS core dumps |

### Finding App Data

To locate a specific app's data:

1. Navigate to `/var/mobile/Containers/Data/Application/`
2. Look for directories with UUID names
3. Each UUID corresponds to an app bundle
4. The app's data (documents, preferences, databases) lives here

### SQLite Databases

iOS apps commonly use SQLite for local storage. A SQLite database generates three files:

- `<name>.db` - Main database file
- `<name>.db-shm` - Shared memory journal file
- `<name>.db-wal` - Write-ahead log file

**Investigation tip:** Look for `.db` files in app data directories. These often contain user data, credentials, or sensitive information.

## Privilege Separation and Sandbox

### User Privileges

- **`mobile` user**: Applications run under this identity
- **`root` user**: System processes run as root

### Sandbox Restrictions

Even apps running as the same user cannot access each other's data. The sandbox:

- Restricts file system access to the app's container
- Requires explicit user permission for protected resources (SMS, contacts, location)
- Enforces access through permission pop-ups

**Pentesting implication:** To access another app's data, you typically need to:
1. Jailbreak the device (bypasses sandbox)
2. Exploit a sandbox escape vulnerability
3. Use legitimate APIs with proper entitlements

## Data Protection Classes

iOS uses the Secure Enclave Processor (SEP) for cryptographic operations. Files are encrypted with unique 256-bit AES keys.

### Protection Classes

| Class | When Accessible | Use Case |
|-------|-----------------|----------|
| `NSFileProtectionComplete` | Only when device is unlocked | Highly sensitive data |
| `NSFileProtectionCompleteUnlessOpen` | While open, even when locked | Files actively in use |
| `NSFileProtectionCompleteUntilFirstUserAuthentication` | After first unlock post-boot | Data needed for background tasks |
| `NSFileProtectionNone` | Always (only device UID protected) | Quick remote wipe scenarios |

**Default since iOS 7:** `NSFileProtectionCompleteUntilFirstUserAuthentication`

### Checking File Protection

Use [FileDP](https://github.com/abjurato/FileDp-Source) to inspect file protection classes:

```bash
# On a jailbroken device with Python
git clone https://github.com/abjurato/FileDp-Source
cd FileDp-Source
python filedp.py /path/to/file
```

## Keychain Security

The Keychain is an encrypted container for sensitive data (passwords, tokens, certificates).

### Keychain Security Model

- Encrypted with AES using a password generated by iOS
- Password derived via PBKDF2 from user passcode + device UID salt
- Device UID only accessible via Secure Enclave
- Managed by `securityd` daemon
- Access controlled by app entitlements

### Keychain API Operations

| Function | Purpose |
|----------|---------|
| `SecItemAdd` | Add new item |
| `SecItemUpdate` | Update existing item |
| `SecItemCopyMatching` | Retrieve item |
| `SecItemDelete` | Remove item |

### Keychain Accessibility Levels

| Attribute | When Accessible | Backup |
|-----------|-----------------|--------|
| `kSecAttrAccessibleAlways` | Always | Yes |
| `kSecAttrAccessibleAlwaysThisDeviceOnly` | Always | No |
| `kSecAttrAccessibleAfterFirstUnlock` | After first unlock | Yes |
| `kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly` | After first unlock | No |
| `kSecAttrAccessibleWhenUnlocked` | When unlocked | Yes |
| `kSecAttrAccessibleWhenUnlockedThisDeviceOnly` | When unlocked | No |
| `kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly` | When passcode set | No |

### Keychain Persistence Risk

**Critical:** Keychain data persists after app uninstallation. A new device owner could:
1. Install the same app
2. Access previous owner's Keychain data

**Mitigation:** Apps should clear Keychain data on first launch or logout.

### Jailbroken Devices Warning

> On jailbroken devices, Keychain protections are significantly compromised. Assume Keychain data is accessible to any app with Keychain access entitlements.

## App Capabilities and Permissions

### Info.plist Investigation

The `Info.plist` file contains app configuration, including privacy permissions.

#### From Xcode Project

1. Open project in Xcode
2. Locate `Info.plist`
3. Search for keys prefixed with `"Privacy -"`
4. View raw keys/values for clarity

#### From IPA File

1. Unzip the IPA (it's a ZIP archive)
2. Navigate to `Payload/<appname>.app/`
3. Find `Info.plist`
4. Convert to XML if needed for easier reading

### Privacy Purpose Strings

Apps must declare why they need certain permissions:

```xml
<key>NSLocationWhenInUseUsageDescription</key>
<string>Your location is used to provide turn-by-turn directions.</string>

<key>NSCameraUsageDescription</key>
<string>Camera access needed to scan documents.</string>

<key>NSPhotoLibraryUsageDescription</key>
<string>Photo library access to select profile pictures.</string>
```

**Pentesting tip:** Compare declared purpose strings with actual app behavior. Mismatches may indicate privacy violations or misconfigured permissions.

### Device Capabilities

Apps declare required hardware capabilities:

```xml
<key>UIRequiredDeviceCapabilities</key>
<array>
    <string>armv7</string>
    <string>arm64</string>
    <string>nfc</string>
</array>
```

This helps the App Store filter compatible devices.

## Entitlements

Entitlements are key-value pairs granting apps special permissions beyond runtime checks.

### Common Entitlements

- `com.apple.developer.icloud-container-identifiers` - iCloud access
- `com.apple.developer.key-chain-access-groups` - Keychain sharing
- `com.apple.developer.team-identifier` - App team identifier
- `application-identifier` - App bundle identifier

### Finding Entitlements

**From Xcode:** Check the project's entitlements file (usually `*.entitlements`)

**From IPA:** Look in `Payload/<appname>.app/embedded.mobileprovision` or `*.entitlements` file

## Investigation Workflow

When starting an iOS app assessment:

1. **Get the app** - IPA file or installed on device
2. **Extract Info.plist** - Review declared permissions and capabilities
3. **Check entitlements** - Identify special access granted
4. **Locate app data** - Find the app's container directory
5. **Search for databases** - Look for `.db` files
6. **Check file protection** - Use FileDP on sensitive files
7. **Investigate Keychain** - Look for stored credentials (requires jailbreak)
8. **Review crash logs** - May contain sensitive data or stack traces

## References

- [OWASP MASTG - iOS Data Storage Testing](https://mas.owasp.org/MASTG/iOS/0x06d-Testing-Data-Storage)
- [OWASP MASTG - Platform Interaction](https://mas.owasp.org/MASTG/iOS/0x06h-Testing-Platform-Interaction/)
- [Apple Keychain Services Documentation](https://developer.apple.com/library/content/documentation/Security/Conceptual/keychainServConcepts/02concepts/concepts.html)
- [FileDP Tool](https://github.com/abjurato/FileDp-Source)