iOS app assessment

When it applies

You have an IPA (or an app on a jailbroken test device) and scope covers the iOS client + its backend. As with Android, most impact is the backend reached through the app, plus local data / keychain leaks and insecure IPC (URL schemes, universal links).

Why it works

The app ships its logic and secrets, and trusts its own device. Decryption + class-dump reveal endpoints and Obj-C/Swift classes; the Keychain and app container often hold tokens; and runtime instrumentation removes jailbreak/pinning checks the server assumed held.

Method

1. Unpack & inspect: decrypt the app (from a jailbroken device / frida-ios-dump), then otool -L, class-dump, and read Info.plist for URL schemes, NSAppTransportSecurity (ATS) exceptions, permissions, and background modes. MobSF for an automated static pass.
2. Local storage: inspect the app container — NSUserDefaults, plists, sqlite, cached files — and the Keychain for tokens/PII stored insecurely (objection → ios keychain dump).
3. Dynamic: objection -g <bundle> explore — bypass jailbreak detection and SSL pinning (→ mobile-cert-pinning-bypass), hook methods, then proxy and test the backend (BOLA/mass-assignment).
4. IPC: URL schemes / universal links (→ mobile-deeplink-abuse), pasteboard leakage, app extensions.

Gotchas

• Non-jailbroken testing is limited — you usually need a jailbroken device or a re-signed app.
• ATS exceptions (NSAllowsArbitraryLoads) signal weakened TLS worth flagging.
• The high-impact bugs are usually server-side reached via the app — proxy and test the API.

Verify success

Concrete impact: leaked working credential/endpoint, keychain/token exposure, unauthenticated IPC reach, or a backend bug proven through the app's traffic.

References

OWASP MASVS/MASTG (iOS); objection & frida-ios-dump; OWASP Mobile Top 10 (2024).