# IOS Pentesting Environment

> Set up and configure iOS security testing environments including simulators, physical devices, and jailbroken devices. Use this skill whenever the user needs to prepare an iOS device for security testing, troubleshoot device pairing issues, understand jailbreak options, or work with iOS testing tooling. Trigger for any iOS pentest setup, device configuration, simulator management, or jailbreak-related tasks.

- Skill: `abelrguezr/ios-pentesting-environment` (Agent Skill, multi-file: 5 files)
- Install (CLI): `npx skillmds@latest add abelrguezr/ios-pentesting-environment`
- Raw SKILL.md: https://api.skillmd.com/api/skills/abelrguezr/ios-pentesting-environment/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: abelrguezr (https://skillmd.com/u/abelrguezr)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/abelrguezr/ios-pentesting-environment

---


# iOS Pentesting Environment Setup

This skill helps you configure iOS devices and environments for security testing. Follow the appropriate section based on your testing needs.

## Quick Start

1. **For simulator testing**: Use the simulator setup section
2. **For physical device testing**: Use the physical device setup section
3. **For jailbroken device testing**: Use the jailbreak setup section

## Apple Developer Program

### Free Development Profile (Xcode 7.2+)

You can create a free iOS development provisioning profile to test on a real iPhone:

1. Open Xcode → Preferences → Accounts
2. Click **+** to add your Apple ID
3. Select your Apple ID → Manage Certificates
4. Click **+** → Apple Development → Done

### Trust the Computer

Before running apps on your iPhone:

1. Connect your iPhone to the computer
2. On iPhone: Settings → General → Profiles and Device Management
3. Select the untrusted profile → Click **Trust**

### iOS 16+ Developer Mode

On iOS 16+, Developer Mode must be enabled for locally installed development-signed apps:

1. Pair the device with Xcode
2. Trigger an install from Xcode
3. Go to Settings → Privacy & Security → Developer Mode
4. Enable Developer Mode
5. Reboot the device
6. Confirm the prompt after unlock

**Note**: Apps signed by the same certificate can share resources like keychain items.

## Modern Host-Side Tooling

### Device Enumeration

```bash
# List booted simulators
xcrun simctl list | grep Booted

# List all visible devices and simulators
xcrun xctrace list devices

# List paired physical devices (Xcode 15+)
xcrun devicectl list devices
```

### Device Control (Xcode 15+)

```bash
# Install an app on a physical device
xcrun devicectl device install app --device <udid> <path_to_app_or_ipa>

# Launch an app (terminating existing instance)
xcrun devicectl device launch app --terminate-existing --device <udid> <bundle_id>
```

**Important**: Keep Xcode updated when testing iOS 17+ devices. Apple moved developer services to the CoreDevice stack, and outdated tooling frequently fails with pairing or app-launch errors.

## Simulator Setup

### Understanding Simulators

A simulator is **not** an emulator. It simulates device behavior but doesn't use actual hardware functions. This means:

- ✅ Good for: filesystem artifacts, NSUserDefaults, plist parsing, custom URL schemes, basic runtime instrumentation
- ❌ Limited for: Secure Enclave, baseband, keychain access-control behaviors, biometric flows, jailbreak-specific conditions

### Finding Simulator Files

1. **Simulator location**: `/Users/<username>/Library/Developer/CoreSimulator/Devices`
2. **Find booted simulator UID**:
   ```bash
   xcrun simctl list | grep Booted
   # Example: iPhone 8 (BF5DA4F8-6BBE-4EA0-BA16-7E3AFD16C06C) (Booted)
   ```
3. **App data location**: `/Users/<username>/Library/Developer/CoreSimulator/Devices/{UID}/data/Containers/Data/Application`
4. **App package location**: `/Users/<username>/Library/Developer/Xcode/DerivedData/{Application}/Build/Products/Debug-iphonesimulator/`

### Opening Simulator

1. Open Xcode
2. Xcode tab → Open Developer Tools → Simulator
3. Select device from the dropdown (e.g., "iPod touch [...]")

## Physical Device Testing

### Requirements

- **Apple Developer Program**: $99/year for provisioning identity to sign apps
- **Alternative**: Use a jailbroken device (see below)

### Provisioning Profile Location

On the device, provisioning profiles are stored at:
```
/Library/MobileDevice/ProvisioningProfiles
```

## Jailbreaking

### What is Jailbreaking?

Jailbreaking circumvents Apple's code signing restrictions, allowing unsigned code to run. Unlike Android rooting:

- **Android rooting**: May involve installing `su` binary or custom ROMs (sometimes without exploits if bootloader is unlocked)
- **iOS jailbreaking**: Requires bypassing Apple's code signing; cannot flash custom ROMs due to bootloader restrictions

### Jailbreak Types

| Type | Description |
|------|-------------|
| **Tethered** | Requires computer connection for each reboot |
| **Semi-tethered** | Can boot into non-jailbroken mode without computer |
| **Semi-untethered** | Manual re-jailbreaking needed, no computer required |
| **Untethered** | Permanent, no re-application needed |

### Current Jailbreak Tools

| Tool | Target Devices | iOS Version |
|------|----------------|-------------|
| **Checkra1n** | A7-A11 chips | iOS 12-14 |
| **Palera1n** | A8-A11 (checkm8-compatible) | iOS/iPadOS 15+ |
| **Dopamine** | arm64/arm64e devices | iOS 15/16 (rootless) |
| **Unc0ver** | Various | Up to iOS 14.8 |

**Resources**:
- [Can I Jailbreak?](https://canijailbreak.com)
- [The iPhone Wiki](https://www.theiphonewiki.com)
- [Reddit Jailbreak](https://www.reddit.com/r/jailbreak/)

### Rootless Jailbreaks (iOS 15+)

Modern jailbreaks are commonly **rootless** instead of **rootful**:

- **Rootless**: Avoids modifying the sealed system volume directly
- **File location**: Jailbreak files stored under `/private/preboot/...` with stable symlink at **`/var/jb`**
- **Impact**: Tweaks, launch daemons, and helper binaries exist under `/var/jb` instead of legacy root locations

**Testing implications**:
- Check both legacy paths and `/var/jb` for tooling installation
- Modern jailbreak detection checks for rootless artifacts and symlinks
- Scripts assuming rootful filesystem may fail silently

### Jailbreak Detection

Apps may detect jailbreaking through:

1. **File/folder presence**: Search for jailbreak-specific files
2. **Rootless artifacts**: Check `/var/jb` and symlinks to `/private/preboot/...`
3. **API behavior**: Some API calls behave differently on jailbroken devices
4. **OpenSSH service**: Presence indicates jailbreak
5. **Shell return value**: Calling `/bin/sh` returns 1 instead of 0

### Jailbreak Detection Bypass

1. **Objection**: Use `ios jailbreak disable` command
2. **Liberty Lite**: Install from https://ryleyangus.com/repo/ (appears in Search tab after adding repo)

## Testing Without Jailbreak

For non-jailbroken device testing, refer to iOS pentesting without jailbreak techniques. This is increasingly common as modern iOS versions make jailbreaking difficult.

## Important Considerations

### iOS Updates

- **Downgrading**: Only possible during limited signing windows after release
- **Signing windows**: Check [IPSW Downloads](https://ipsw.me) for current status
- **Recommendation**: Don't update testing devices unless re-jailbreaking is guaranteed

### Security Risks

Jailbreaking removes OS-imposed sandboxing, allowing:
- ✅ Full filesystem access
- ✅ Installation of unapproved apps
- ✅ Access to more APIs
- ⚠️ Potential security risks
- ⚠️ Device instability

## Troubleshooting

### Device Not Pairing (iOS 17+)

1. Update Xcode to latest version
2. Check Developer Mode is enabled (Settings → Privacy & Security)
3. Verify device is trusted on computer
4. Reboot device after enabling Developer Mode

### App Won't Launch

1. Verify provisioning profile is valid
2. Check Developer Mode is enabled (iOS 16+)
3. Ensure device is trusted
4. For jailbroken devices: check jailbreak detection bypass is active

### Simulator Issues

1. Verify Xcode is downloaded from official App Store
2. Check simulator is booted: `xcrun simctl list | grep Booted`
3. Clear derived data: `rm -rf ~/Library/Developer/Xcode/DerivedData/*`

## References

- [OWASP MASTG iOS Security Testing](https://mas.owasp.org/MASTG/iOS/0x06b-iOS-Security-Testing/)
- [Apple Developer Mode Documentation](https://developer.apple.com/documentation/xcode/enabling-developer-mode-on-a-device)
- [Palera1n Environment Types](https://docs.palera.in/docs/reference/environment-types/)
- [Trustwave Jailbreak Detection Methods](https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/jailbreak-detection-methods/)