iOS/macOS penetration testing cheatsheet

| Action | macOS | Linux | Win | iOS w/JB | | --- | --- | --- | --- | --- | |

MobSF

Plist view

apt-get install libplist-utils

Ghidra

Frida

Awesome Frida

Objection

Needle

Keychain dumper

iOS URL Schemes

Debug Hacks

SandBox Dumper

PassionFruit

iPhoneTunnel

iRET

idb

XSecurity

macOS Quick Look plugin for iOS & OSX developers

https://github.com/ealeksandrov/ProvisionQL – Generate amazing preview for

.ipa

.app

.appex

.mobileprovision

.provisionprofile

iOS / macOS obfuscation

https://github.com/obfuscator-llvm/obfuscator/wiki – ollvm

Static analyze

| Project/App | Swift | Objective-c | | --- | --- | --- | | Swift Lint | + | - |

Jailbreak

| Jailbreak check | | --- | | Jailbreak Chart | | Can I Jailbreak? | | Jailbreak list |

| Repos | | --- | | http://cydia.iphonecake.com | | http://apt.saurik.com/ | | http://repo.nesolabs.de/ | | https://build.frida.re/ | | http://appsec-labs.com/cydia/ | | http://cydia.zodttd.com/repo/cydia/ | | http://mobiletools.mwrinfosecurity.com/cydia/ | | http://repo666.ultrasn0w.com/ | | http://apt.thebigboss.org/repofiles/cydia/ | | http://cydia.radare.org/ | | http://apt.modmyi.com/ | | http://coolstar.org/publicrepo/ | | http://getdelta.co/ < Flex3 working | | http://julioverne.github.io/ | | http://brunonfl.github.io/ | | http://apt.bingner.com/ | | http://repo.dynastic.co/ | | http://mcapollo.github.io/Public/ | | http://apt.hackcn.net/ | | http://repo.chariz.io/ | | http://cydia.ichitaso.com/ | | https://level3tjg.github.io < bfdecrypt (ios11/ios12)| | http://ryleyangus.com/repo < Liberty Lite (beta) for JB bypas|

Little h4ck for sslpinning bypass (help in some cases when sslkillswitch useless)

• Configure burp proxy on iOS device – Visit [yourproxyadress]:[proxy_port]/mobileassistant.deb – Download file and install
  • Via iFile
  • Via ssh like `dpkg -i path/to/mobileassistant.deb
• Respring
• Launch Mobile Assistant
• Add app in bottom panel
• Turn-on switcher next to app
• Launch your app
• Congrats

More info here NB! in some cases you may face with lack of libraries, do not replace anything manually in iOS, it may lead to infinity loop)

AppSign / Rebuild / Resign / Inject / Useful tools

Download and decrypt

| Tool | Description | Link | | --- | --- | --- | |

iFunBox

Appdb

iphonecake

4pda

iTunes w/app tab

Download old version .ipa

Extract data

| Tool | Description | Link | | --- | --- | --- | |

Rasticrac

Clutch

bfinject

All in one (Inject > Repack > Resign > Upload)

| Tool | Description | Link | | --- | --- | --- | |

IPA Patch

Resign

Inject framework

| Tool | Description | Link | | --- | --- | --- | |

CydiaSubstrate

Reveal app

JSPatch

FRAPL

Frida Gadget

Cycript

Repack and resign binary

| Tool | Description | Link | | --- | --- | --- | |

Node Resign

iOS App Signer

AppAddict

Upload and run on device

| Tool | Description | Link | | --- | --- | --- | |

iFunBox

Impactor

IPA installer

Useful tools

| Tool | Description | Link | | --- | --- | --- | |

Runtime Headers

SSL Killswitch 2

Theos

Dumpdecrypted

BundleID

IPSW

Slides and articles and links

| Name | Link | | --- | --- | |

Malware wellbeing on iOS devices

DVIA

Dynamic analysis of iOS apps w/o Jailbreak

Ro(o)tten Apples Vulnerability Heaven in the iOS Sandbox

Light and Dark side of Code Instrumentation

Комбайны безопасности для iOS и Android

Author: @ansjdnakjdnajkd

Do you want to add or fix? - Write to me or pull request!