IOS Pentesting Checklist

iOS Pentesting Checklist

A comprehensive guide for security testing iOS applications. Follow this checklist systematically to identify vulnerabilities in iOS apps.

Preparation

Before starting your assessment:

1. Review iOS fundamentals - Understand iOS architecture, sandboxing, and security model
2. Set up your testing environment - Configure jailbroken device, Frida, and necessary tools
3. Perform initial analysis - Examine the app's Info.plist, entitlements, and basic structure

Data Storage Analysis

iOS apps store data in multiple locations. Check each for sensitive information:

Plist Files

• Search for .plist files in the app's sandbox
• Look for hardcoded credentials, API keys, or configuration data
• Check ~/Library/Preferences/ and app container directories

Databases

• Core Data (SQLite): Check *.sqlite and *.sqlite3 files
• YapDatabase: Look for YapDatabase files
• Realm: Search for .realm files
• Couchbase Lite: Check for Couchbase Lite databases
• Firebase: Review Realtime Database configurations for misconfigurations

Other Storage

• Binary cookies: Check for stored session tokens
• Cache data: Review ~/Library/Caches/ for sensitive cached content
• Automatic snapshots: Check for screenshots or UI snapshots containing sensitive data
• Keychain: Enumerate keychain items for stored credentials

Key principle: Systematically check the entire app filesystem for any sensitive information.

Keyboard Security

• Verify if the app allows custom keyboards
• Check keyboard cache files for leaked sensitive input
• Test if sensitive fields disable custom keyboards properly

Log Analysis

• Review system logs for leaked sensitive information
• Check app-specific logs in ~/Library/Logs/
• Look for debug logging that may expose credentials or tokens

Backup Analysis

• Extract and analyze app backups for sensitive data
• Test if modifying backup configurations can bypass security controls
• Restore modified backups to test configuration bypasses

Memory Analysis

• Dump and analyze application memory for sensitive data
• Look for credentials, tokens, or PII in memory
• Use tools like Frida to inspect runtime memory

Cryptography Review

• Search for hardcoded encryption keys or passwords
• Identify deprecated or weak cryptographic algorithms
• Hook and monitor cryptographic function calls
• Verify proper use of iOS Keychain for key storage

Local Authentication Testing

If the app uses local authentication (Face ID, Touch ID, passcode):

• Local Authentication Framework: Test for bypass vulnerabilities
• Custom implementations: Create Frida scripts to dynamically bypass authentication
• Check if authentication can be bypassed by modifying keychain access

IPC and Inter-App Communication

Custom URI Handlers / Deeplinks

• Enumerate registered protocols and schemes in Info.plist
• Test if the app registers to use external protocols
• Attempt to intercept data via custom schemes
• Test input sanitization on scheme parameters
• Check for exposed sensitive actions callable via schemes

Universal Links

• Review registered universal protocols
• Analyze apple-app-site-association file
• Test input sanitization on universal link parameters
• Check for exposed sensitive actions

UIActivity Sharing

• Test if the app receives UIActivities
• Attempt exploitation with specially crafted activities

UIPasteboard

• Monitor if the app copies sensitive data to pasteboard
• Check if the app reads from general pasteboard
• Test for sensitive data leakage via clipboard

App Extensions

• Identify any app extensions (Today widgets, Share extensions, etc.)
• Test extension security boundaries

WebViews

• Identify WebView types used (WKWebView vs UIWebView)
• Check security settings:
  • javaScriptEnabled
  • JavaScriptCanOpenWindowsAutomatically
  • hasOnlySecureContent
• Test file access: allowFileAccessFromFileURLs, allowUniversalAccessFromFileURLs
• Check JavaScript-to-native bridges (JSContext, postMessage)

Network Security

• Perform Man-in-the-Middle attacks on app communication
• Verify hostname validation on certificates
• Test and bypass certificate pinning mechanisms
• Check for unencrypted data transmission

Additional Checks

• Hot patching: Identify automatic update mechanisms that could be exploited
• Third-party libraries: Audit dependencies for known vulnerabilities or malicious code
• Code obfuscation: Check if the app uses obfuscation and test its effectiveness

Testing Workflow

1. Static Analysis: Review app binaries, Info.plist, and resources
2. Dynamic Analysis: Run the app and monitor behavior
3. Instrumentation: Use Frida to hook and modify runtime behavior
4. Network Analysis: Intercept and modify network traffic
5. Data Extraction: Extract and analyze stored data
6. Bypass Testing: Attempt to bypass security controls

Reporting

Document all findings with:

• Vulnerability description
• Steps to reproduce
• Impact assessment
• Remediation recommendations
• Evidence (screenshots, logs, code snippets)

Tools Reference

• Frida: Runtime instrumentation
• Objection: Mobile security testing toolkit
• Cycript: Runtime introspection
• class-dump: Extract headers from binaries
• iMazing: Backup management
• Burp Suite: Network interception
• MobSF: Mobile security framework