Thread by @NandanLohitaksh

Interested in learning iOS Penetration Testing?
Here is how you can start 👇🧵

#bugbounty #bugbountytips #cybersecurity #hacking

Requirements:
- Mac (Intel/M1/M2) Or Mobexler virtual machine (Apple proprietary tools not available)
- Jailbroken iPhone Or Corellium virtual iOS device

Starting iOS App Pentest:
- Reverse engineer the IPA to check for hardcoded secrets, sensitive info etc. (Book Ref: amazon.com/Mobile-App-Rev…)
- Run MobSF static analysis, review the findings and manually validate the interesting points

- Install the IPA on jailbroken test device {Use AppSync unified/Re-sign with iOS App signer (dev account needed)}
- Run the app --> capture traffic (SSL pinning bypass with Frida/Objections)
- Perform all API related test cases

- Test Deeplinks, insecure local storage, logic bypass with response modification etc.
- Find more interesting test cases from the info you gained so far

Resources:
- Mobexler: mobexler.com
- Everything you need to know about Mobexler:
- Mobile Application Security Verification Standard: mas.owasp.org/MASVS/
- Jailbreaking steps: ios.cfw.guide/installing-pal…

#ios #pentesting #infosec