performing-ios-app-security-assessment

Performs comprehensive iOS application security assessments using Frida for dynamic instrumentation, Objection for runtime exploration, SSL pinning bypass for traffic interception, keychain extraction for credential analysis, and IPA static analysis for binary-level review. Use when conducting authorized iOS penetration tests, evaluating mobile app security posture against OWASP MASTG, or assessing iOS app data protection and transport security controls. Activates for requests involving iOS app pentesting, Frida-based iOS instrumentation, mobile app SSL pinning bypass, or IPA reverse engineering.

仓库: mukul975/Anthropic-Cybersecurity-Skills
最近来源活动: 2026年6月1日 10:13
检测到的 SKILL.md 语言: 英语
星标: 27,732
分支: 3,366

安装方式

默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。

检查来源文件

决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。

返回搜索返回安装

name	performing-ios-app-security-assessment
description	Performs comprehensive iOS application security assessments using Frida for dynamic instrumentation, Objection for runtime exploration, SSL pinning bypass for traffic interception, keychain extraction for credential analysis, and IPA static analysis for binary-level review. Use when conducting authorized iOS penetration tests, evaluating mobile app security posture against OWASP MASTG, or assessing iOS app data protection and transport security controls. Activates for requests involving iOS app pentesting, Frida-based iOS instrumentation, mobile app SSL pinning bypass, or IPA reverse engineering.
domain	cybersecurity
subdomain	mobile-security
author	mukul975
tags	["mobile-security","ios","frida","objection","ssl-pinning","keychain","ipa-analysis","owasp-mastg"]
version	1.0.0
license	Apache-2.0
nist_csf	["PR.PS-01","PR.AA-05","ID.RA-01","DE.CM-09"]
mitre_attack	["T1059","T1056","T1036","T1078","T1003"]

Performing iOS App Security Assessment

Disclaimer

This skill is intended for authorized security testing, penetration testing engagements, CTF competitions, and educational purposes only. Unauthorized access to applications or devices is illegal. Always obtain written authorization before performing any security assessment. Misuse of these techniques may violate computer fraud and abuse laws in your jurisdiction.

When to Use

Use this skill when:

Conducting authorized penetration tests of iOS applications against OWASP MASVS/MASTG criteria
Performing dynamic analysis of iOS apps using Frida instrumentation and Objection runtime exploration
Bypassing SSL/TLS certificate pinning to intercept and analyze app network traffic through a proxy
Extracting and auditing iOS Keychain contents for insecure credential storage practices
Performing static analysis of IPA packages to identify hardcoded secrets, entitlements, and binary protections
Assessing jailbreak detection and anti-tampering controls in iOS applications

Do not use against applications without explicit written authorization. Do not use on production devices containing real user data unless the engagement scope permits it.

Prerequisites

Python 3.10+ with pip
Frida toolkit: pip install frida-tools frida
Objection: pip install objection
Target iOS device (jailbroken with frida-server, or non-jailbroken with patched IPA)
macOS with Xcode command-line tools (recommended for code signing and ideviceinstaller)
Burp Suite or mitmproxy for traffic interception after SSL pinning bypass
For jailbroken devices: SSH access and frida-server running on the device
For non-jailbroken devices: Apple Developer certificate for IPA re-signing

Workflow

Step 1: IPA Static Analysis

Extract and analyze the IPA binary before runtime testing:

# Unzip IPA for static analysis
unzip target.ipa -d target_app/

# Check binary architectures and protections
otool -hv target_app/Payload/*.app/AppExecutable
otool -l target_app/Payload/*.app/AppExecutable | grep -A4 LC_ENCRYPTION

# Extract Info.plist for entitlements and URL schemes
plutil -p target_app/Payload/*.app/Info.plist

# Search for hardcoded secrets in binary strings
strings target_app/Payload/*.app/AppExecutable | grep -iE "api[_-]?key|secret|password|token|firebase"


security cms -D -i target_app/Payload/*.app/embedded.mobileprovision


otool -L target_app/Payload/*.app/AppExecutable

# For jailbroken device: verify Frida server is running
frida-ps -U

# Spawn target app with Frida
frida -U -f com.target.app --no-pause

# For non-jailbroken device: patch IPA with Frida Gadget
objection patchipa --source target.ipa --codesign-signature "Apple Development: tester@example.com"

# Install patched IPA
ideviceinstaller -i target-patched.ipa

# Attach Objection to running app
objection --gadget "com.target.app" explore

# Using Objection's built-in bypass
objection --gadget "com.target.app" explore --startup-command "ios sslpinning disable"

# Using Frida script for more comprehensive bypass
frida -U -f com.target.app -l ssl_pinning_bypass.js --no-pause

# Verify bypass by configuring device proxy to Burp Suite
# Device Settings -> Wi-Fi -> HTTP Proxy -> Manual -> <burp_ip>:8080
# Install Burp CA certificate on device via http://<burp_ip>:8080/cert

# Dump all accessible keychain items via Objection
ios keychain dump

# Dump keychain with raw data output
ios keychain dump --json

# Check keychain item accessibility attributes
# Items with kSecAttrAccessibleAlways or kSecAttrAccessibleAfterFirstUnlock
# are accessible without device unlock - this is a finding

# Search for specific credential types
ios keychain dump | grep -i "password\|token\|secret\|oauth"

# Inspect NSUserDefaults for sensitive data leaks
ios nsuserdefaults get

# Check for sensitive data in app cookies
ios cookies get

# List all loaded classes
ios hooking list classes

# Search for security-relevant classes
ios hooking search classes Auth
ios hooking search classes Crypto
ios hooking search classes Biometric
ios hooking search classes Jailbreak

# Hook authentication methods to observe parameters and return values
ios hooking watch method "+[AuthManager validateCredentials:password:]" --dump-args --dump-return

# Monitor biometric authentication (LocalAuthentication framework)
ios hooking watch class LAContext

# Bypass jailbreak detection
ios jailbreak disable

# Search memory for sensitive strings
memory search "Bearer " --string
memory search "password" --string

# Dump loaded modules for third-party library identification
memory list modules

# List files in app sandbox
env

# Check for SQLite databases with sensitive data
sqlite connect Documents/app.db
sqlite execute query "SELECT name FROM sqlite_master WHERE type='table'"

# Inspect plist files for cached credentials
ios plist cat Library/Preferences/com.target.app.plist

# Check for sensitive data in app caches
find Library/Caches/ -type f

# Monitor pasteboard for credential leakage
ios pasteboard monitor

# Check binary cookies
ios cookies get

# Verify App Transport Security (ATS) configuration in Info.plist
# Check for NSAllowsArbitraryLoads = true (disables ATS)
ios plist cat Info.plist | grep -A5 NSAppTransportSecurity

# Hook URL session delegates to monitor all network calls
ios hooking watch class NSURLSession
ios hooking watch class NSURLSessionConfiguration

# Check for certificate transparency validation
ios hooking search classes CT
ios hooking search classes Certificate

Term	Definition
Frida	Dynamic instrumentation toolkit that injects a JavaScript engine into target processes, enabling runtime hooking, tracing, and modification of iOS app behavior
Objection	Runtime mobile exploration toolkit built on Frida providing pre-built commands for common security tests including keychain dump, SSL pinning bypass, and method hooking
SSL Pinning	Client-side certificate validation that restricts which TLS certificates the app trusts, preventing proxy-based traffic interception; bypassed by hooking trust evaluation functions
Keychain	iOS secure storage API for credentials and tokens; items have accessibility attributes that control when they can be read (e.g., only when device is unlocked)
IPA	iOS App Store Package; a ZIP archive containing the app binary, frameworks, assets, and provisioning profile that can be extracted for static analysis
OWASP MASTG	Mobile Application Security Testing Guide; comprehensive methodology for iOS and Android security testing organized by MASVS verification categories
Frida Gadget	Shared library (.dylib) injected into IPA for non-jailbroken testing; enables Frida instrumentation without requiring a jailbroken device
Method Swizzling	Objective-C runtime technique that exchanges method implementations at runtime; used by Frida to intercept and modify method behavior

## Finding: Insecure Keychain Storage with kSecAttrAccessibleAlways

**ID**: IOS-001
**Severity**: High (CVSS 7.5)
**OWASP MASTG**: MASTG-TEST-0055 (Testing Data Storage)
**MASVS Category**: MASVS-STORAGE

**Description**:
The application stores OAuth refresh tokens in the iOS Keychain with
the accessibility attribute kSecAttrAccessibleAlways, making them
readable even when the device is locked or after a reboot without
user authentication.

**Proof of Concept**:
1. Attach Objection to com.target.app: objection --gadget com.target.app explore
2. Execute: ios keychain dump
3. Observe refresh_token item with Accessible: kSecAttrAccessibleAlways
4. Token value is accessible without device unlock

**Impact**:
An attacker with physical access to a locked device or forensic
image can extract OAuth refresh tokens and gain persistent access
to the user's account without knowing device passcode.

**Remediation**:
Store sensitive credentials with kSecAttrAccessibleWhenUnlockedThisDeviceOnly
and enable biometric protection via kSecAccessControlBiometryCurrentSet.