mobile-pentesting-ios

name	mobile-pentesting-ios
description	Guide complet de pentest iOS — IPA reverse engineering, Frida, Objection, SSL pinning bypass, jailbreak detection, dynamic analysis
category	cybersecurite

Mobile Pentesting iOS — Guide Avancé

Prérequis

Environnement macOS

# Les outils iOS nécessitent macOS
# Xcode + Command Line Tools
xcode-select --install

# Theos — tweak development
git clone https://github.com/theos/theos.git ~/theos

# Homebrew
brew install ldid class-dump

Device Jailbreaké (Recommandé)

# Checkra1n (A5-A11)
# Palera1n (A8-A11)
# Dopamine / Fugu15 (A12+, iOS 15-16)
# XinaA15 (A12-A15, iOS 15)

Installation des Outils

# Frida sur le device iOS
# Depuis Cydia/Sileo: frida
# Ou via SSH
ssh root@192.168.1.10
wget https://build.frida.re/frida/ios/Frida_16.5.6.deb
dpkg -i Frida_16.5.6.deb

# Côté hôte
pip install frida-tools object

# objection
pip install objection

Reverse Engineering d'IPA

Extraction d'IPA (Depuis App Store)

# Méthode 1: Apple Configurator 2 + extraction
# Dans iTunes (ancien): télécharger l'IPA depuis l'App Store
# Méthode 2: ipatool (nécessite Apple ID)
ipatool download -b com.target.app -o target.ipa

# Méthode 3: Frida iOS Dump
frida-ios-dump -u -o target.ipa com.target.app

# Méthode 4: Clutch (ancien iOS)
clutch -d com.target.app

Extraction d'IPA (Depuis Device)

# Vérifier les applications installées
frida-ps -U -a

# Dumper avec frida-ios-dump
frida-ios-dump -U com.target.app -o target.ipa

Analyse du Binaire

Désassemblage:

# Vérifier l'architecture
lipo -info target.app/target
# Output: Non-fat file, architecture arm64

# Décrypter le Mach-O (si nécessaire)
# Les apps de l'App Store sont chiffrées
# Utiliser frida-ios-dump qui automatise ça

# Strings
strings target.app/target | grep -i "key\|token\|secret\|http\|password"

# class-dump pour les headers Objective-C
class-dump target.app/target -H -o headers/

# Ghidra / Hopper / IDA
# Analyser le binaire Mach-O déchiffré

Analyse avec radare2/cutter:

radare2 -A target.app/target
> aaaa  # Analyse complète
> afl   # Liste des fonctions
> is    # Liste des symboles
> izz   # Strings du binaire
> ii    # Imports
> axf   # Références croisées

Analyse du Plist et Ressources

# Info.plist
plutil -p target.app/Info.plist

# Points importants:
# - CFBundleURLSchemes (deep links)
# - NSAppTransportSecurity (ATS exception)
# - UIApplicationExitsOnSuspend
# - UIBackgroundModes
# - NSFaceIDUsageDescription
# - CFBundleIdentifier

# Storyboards / XIBs (interface UI)
ibtool --dump target.app/Base.lproj/Main.storyboard

# Fichiers de ressources
ls -la target.app/*.nib
ls -la target.app/*.png

SSL Pinning Bypass

Objection — Simple

# Lancer Objection
objection -g com.target.app explore

# SSL Pinning disable
ios sslpinning disable

# Dump keychain
ios keychain dump

Frida — TrustKit / AFNetworking / Alamofire

// SSL Pinning Bypass iOS — Universal
if (ObjC.available) {
    // NSURLSession ATS bypass
    var NSURLSession = ObjC.classes.NSURLSession;
    
    // TrustKit bypass
    var TrustKit = ObjC.classes.TrustKit;
    if (TrustKit) {
        TrustKit['+ sharedInstance'].implementation = function() {
            return null;
        };
    }

    // AFNetworking bypass
    var AFSecurityPolicy = ObjC.classes.AFSecurityPolicy;
    if (AFSecurityPolicy) {
        AFSecurityPolicy['- setSSLPinningMode:'] = function(mode) {
            console.log('[+] AFSecurityPolicy pinning blocked');
        };
        AFSecurityPolicy['- allowInvalidCertificates'] = function() {
            return 1;
        };
        AFSecurityPolicy['- validatesDomainName'] = function() {
             ;
        };
    }

    
      = ..;
     () {
        [] = () {
             ;
        };
    }

    
      = ..;
    [] = () {
        .();
        
    };
}

Frida Script — NSURLSession Challenge Bypass

if (ObjC.available) {
    var delegate = ObjC.classes.NSObject;
    delegate['- URLSession:didReceiveChallenge:completionHandler:'].implementation = function(
        session, challenge, completionHandler
    ) {
        console.log('[+] Challenge received: ' + challenge.NSURLAuthenticationMethod());
        var protectionSpace = challenge.protectionSpace();
        var host = protectionSpace.host();
        console.log('[+] Host: ' + host);
        
        // Accept all certificates
        var disposition = 1; // NSURLSessionAuthChallengeUseCredential
        var credential = ObjC.classes.NSURLCredential.credentialForTrust_(challenge.protectionSpace().serverTrust());
        
        var block = new ObjC.Block({
            retType: 'void',
            argTypes: ['int', 'object'],
            implementation: function(disp, cred) {
                console.();
            }
        });
        (disposition, credential);
    };
}

Jailbreak Detection Bypass

Methodes de détection

# Les apps vérifient:
# - /Applications/Cydia.app
# - /Library/MobileSubstrate/
# - /bin/bash
# - /usr/sbin/sshd
# - /etc/apt
# - /private/var/lib/apt/
# - Sandbox integrity
# - Fork() test
# - dyld dynamic libraries
# - sysctl(readOnly)

Frida — Shadow Bypass

if (ObjC.available) {
    // FileManager check bypass
    var NSFileManager = ObjC.classes.NSFileManager;
    NSFileManager['- fileExistsAtPath:'].implementation = function(path) {
        var blocklist = [
            '/Applications/Cydia.app',
            '/Library/MobileSubstrate/',
            '/bin/bash', '/usr/sbin/sshd',
            '/etc/apt', '/private/var/lib/apt/'
        ];
        for (var i = 0; i < blocklist.length; i++) {
            if (path.isEqualToString(blocklist[i])) {
                console.log('[+] Blocked jailbreak check: ' + path);
                return 0;
            }
        }
        return this['- fileExistsAtPath:'](path);
    };

    // system() calls
    var NSTask = ObjC.classes.NSTask;
    if (NSTask) {
        NSTask['- launch'].implementation = function() {
             path = .();
             (path.() || path.()) {
                .( + path);
                ;
            }
            []();
        };
    }

    
      = {};
    . = () {  ; };

    
     dlopen =  (.(, ), , [, ]);
    
}

Shadow (iOS Tweak)

# Shadow est un tweak Cydia qui masque le jailbreak
# Installation: Cydia → installer Shadow
# Configurer dans Réglages → Shadow

Analyse Dynamique

Network Traffic

# mitmproxy sur macOS
mitmproxy -p 8080

# Proxy global iOS
# Réglages → Wi-Fi → Proxy → Manuel
# IP hôte + port 8080

# Installer le certificat
# Safari → mitm.it → télécharger le cert iOS
# Réglages → Profil → Installer
# Réglages → Général → À propos → Trust settings → Activer

# rvictl — Remote Virtual Interface (network dump)
rvictl -s <UDID>  # Créer une interface virtuelle
sudo tcpdump -i rvi0 -w capture.pcap

# Voir les flux
sudo ifconfig rvi0

Keychain Analysis

// Frida — Keychain Dump
if (ObjC.available) {
    var secItemCopyMatching = Module.findExportByName('Security', 'SecItemCopyMatching');
    Interceptor.attach(secItemCopyMatching, {
        onEnter: function(args) {
            console.log('[+] SecItemCopyMatching called');
        },
        onLeave: function(retval) {
            console.log('[+] Ret: ' + retval);
        }
    });
}

# Objection — keychain dump
objection -g com.target.app explore
ios keychain dump

Frida — Crypto Operations

if (ObjC.available) {
    // CommonCrypto intercept
    var CCCrypt = Module.findExportByName('libcommonCrypto.dylib', 'CCCrypt');
    Interceptor.attach(CCCrypt, {
        onEnter: function(args) {
            console.log('[+] CCCrypt called');
            console.log('Operation: ' + args[0]);
            console.log('Algorithm: ' + args[1]);
            console.log('Options: ' + args[2]);
            console.log('Key data: ' + Memory.readByteArray(args[5], 32));
        }
    });

    // NSData base64 encoding
    var NSData = ObjC.classes.NSData;
    NSData['- base64EncodedStringWithOptions:'].implementation = function(opts) {
         result = [](opts);
        .( + result);
         result;
    };

    
      = ..;
    []. = () {
        .( + obj);
         [](obj, secure, err);
    };
}

Outils Essentiels

Outil	Description
Frida	Dynamic instrumentation (iOS + macOS)
Objection	Mobile exploration framework
frida-ios-dump	Dump décrypté d'IPA
class-dump	Export des headers Objective-C
Ghidra	Reverse engineering suite
Hopper	Disassembler/decompiler
Needle	iOS security testing framework
iOS-Analysis-Toolkit	iOS pentest automation
IPATool	Téléchargement IPA CLI
Cycript	Objective-C runtime inspection

iOS App Security Checklist

1. IPA extraction et décryptage
2. Analyse Info.plist (ATS, URL schemes)
3. Reverse engineering du binaire (strings, class-dump)
4. SSL pinning bypass
5. Jailbreak detection bypass
6. Keychain data analysis
7. NSUserDefaults / plist inspection
8. SQLite / CoreData analysis
9. Network traffic interception
10. Deep link injection
11. Cryptographic weakness assessment
12. UIPasteboard data leakage
13. TouchID/FaceID bypass
14. Insecure data storage (cache, cookies)
15. Third-party SDK analysis (crashlytics, analytics)

Ressources

• HackTricks iOS: https://book.hacktricks.wiki/en/mobile-pentesting/ios-pentesting/index.html
• Frida CodeShare: https://codeshare.frida.re/
• objection: https://github.com/sensepost/objection
• frida-ios-dump: https://github.com/AloneMonkey/frida-ios-dump
• Needle: https://github.com/nccgroup/needle
• iOS Security Guide: https://developer.apple.com/library/archive/documentation/Security/Conceptual/Security_Overview/