IOS Pentesting Environment

iOS Pentesting Environment Setup

This skill helps you configure iOS devices and environments for security testing. Follow the appropriate section based on your testing needs.

Quick Start

1. For simulator testing: Use the simulator setup section
2. For physical device testing: Use the physical device setup section
3. For jailbroken device testing: Use the jailbreak setup section

Apple Developer Program

Free Development Profile (Xcode 7.2+)

You can create a free iOS development provisioning profile to test on a real iPhone:

1. Open Xcode → Preferences → Accounts
2. Click + to add your Apple ID
3. Select your Apple ID → Manage Certificates
4. Click + → Apple Development → Done

Trust the Computer

Before running apps on your iPhone:

1. Connect your iPhone to the computer
2. On iPhone: Settings → General → Profiles and Device Management
3. Select the untrusted profile → Click Trust

iOS 16+ Developer Mode

On iOS 16+, Developer Mode must be enabled for locally installed development-signed apps:

1. Pair the device with Xcode
2. Trigger an install from Xcode
3. Go to Settings → Privacy & Security → Developer Mode
4. Enable Developer Mode
5. Reboot the device
6. Confirm the prompt after unlock

Note: Apps signed by the same certificate can share resources like keychain items.

Modern Host-Side Tooling

Device Enumeration

# List booted simulators
xcrun simctl list | grep Booted

# List all visible devices and simulators
xcrun xctrace list devices

# List paired physical devices (Xcode 15+)
xcrun devicectl list devices

Device Control (Xcode 15+)

# Install an app on a physical device
xcrun devicectl device install app --device <udid> <path_to_app_or_ipa>

# Launch an app (terminating existing instance)
xcrun devicectl device launch app --terminate-existing --device <udid> <bundle_id>

Important: Keep Xcode updated when testing iOS 17+ devices. Apple moved developer services to the CoreDevice stack, and outdated tooling frequently fails with pairing or app-launch errors.

Simulator Setup

Understanding Simulators

A simulator is not an emulator. It simulates device behavior but doesn't use actual hardware functions. This means:

• ✅ Good for: filesystem artifacts, NSUserDefaults, plist parsing, custom URL schemes, basic runtime instrumentation
• ❌ Limited for: Secure Enclave, baseband, keychain access-control behaviors, biometric flows, jailbreak-specific conditions

Finding Simulator Files

1. Simulator location: /Users/<username>/Library/Developer/CoreSimulator/Devices
2. Find booted simulator UID:

   xcrun simctl list | grep Booted
   # Example: iPhone 8 (BF5DA4F8-6BBE-4EA0-BA16-7E3AFD16C06C) (Booted)
   

3. App data location: /Users/<username>/Library/Developer/CoreSimulator/Devices/{UID}/data/Containers/Data/Application
4. App package location: /Users/<username>/Library/Developer/Xcode/DerivedData/{Application}/Build/Products/Debug-iphonesimulator/

Opening Simulator

1. Open Xcode
2. Xcode tab → Open Developer Tools → Simulator
3. Select device from the dropdown (e.g., "iPod touch [...]")

Physical Device Testing

Requirements

• Apple Developer Program: $99/year for provisioning identity to sign apps
• Alternative: Use a jailbroken device (see below)

Provisioning Profile Location

On the device, provisioning profiles are stored at:

/Library/MobileDevice/ProvisioningProfiles

Jailbreaking

What is Jailbreaking?

Jailbreaking circumvents Apple's code signing restrictions, allowing unsigned code to run. Unlike Android rooting:

• Android rooting: May involve installing su binary or custom ROMs (sometimes without exploits if bootloader is unlocked)
• iOS jailbreaking: Requires bypassing Apple's code signing; cannot flash custom ROMs due to bootloader restrictions

Jailbreak Types

Current Jailbreak Tools

Resources:

• Can I Jailbreak?
• The iPhone Wiki
• Reddit Jailbreak

Rootless Jailbreaks (iOS 15+)

Modern jailbreaks are commonly rootless instead of rootful:

• Rootless: Avoids modifying the sealed system volume directly
• File location: Jailbreak files stored under /private/preboot/... with stable symlink at /var/jb
• Impact: Tweaks, launch daemons, and helper binaries exist under /var/jb instead of legacy root locations

Testing implications:

• Check both legacy paths and /var/jb for tooling installation
• Modern jailbreak detection checks for rootless artifacts and symlinks
• Scripts assuming rootful filesystem may fail silently

Jailbreak Detection

Apps may detect jailbreaking through:

1. File/folder presence: Search for jailbreak-specific files
2. Rootless artifacts: Check /var/jb and symlinks to /private/preboot/...
3. API behavior: Some API calls behave differently on jailbroken devices
4. OpenSSH service: Presence indicates jailbreak
5. Shell return value: Calling /bin/sh returns 1 instead of 0

Jailbreak Detection Bypass

1. Objection: Use ios jailbreak disable command
2. Liberty Lite: Install from https://ryleyangus.com/repo/ (appears in Search tab after adding repo)

Testing Without Jailbreak

For non-jailbroken device testing, refer to iOS pentesting without jailbreak techniques. This is increasingly common as modern iOS versions make jailbreaking difficult.

Important Considerations

iOS Updates

• Downgrading: Only possible during limited signing windows after release
• Signing windows: Check IPSW Downloads for current status
• Recommendation: Don't update testing devices unless re-jailbreaking is guaranteed

Security Risks

Jailbreaking removes OS-imposed sandboxing, allowing:

• ✅ Full filesystem access
• ✅ Installation of unapproved apps
• ✅ Access to more APIs
• ⚠️ Potential security risks
• ⚠️ Device instability

Troubleshooting

Device Not Pairing (iOS 17+)

1. Update Xcode to latest version
2. Check Developer Mode is enabled (Settings → Privacy & Security)
3. Verify device is trusted on computer
4. Reboot device after enabling Developer Mode

App Won't Launch

1. Verify provisioning profile is valid
2. Check Developer Mode is enabled (iOS 16+)
3. Ensure device is trusted
4. For jailbroken devices: check jailbreak detection bypass is active

Simulator Issues

1. Verify Xcode is downloaded from official App Store
2. Check simulator is booted: xcrun simctl list | grep Booted
3. Clear derived data: rm -rf ~/Library/Developer/Xcode/DerivedData/*

References

• OWASP MASTG iOS Security Testing
• Apple Developer Mode Documentation
• Palera1n Environment Types
• Trustwave Jailbreak Detection Methods