/ios-pentest

OWASP MASTG iOS Testing Checklist

Complete checklist based on OWASP Mobile Application Security Testing Guide (MASTG) for iOS.

MASVS-STORAGE: Data Storage

MASTG-TEST-0052: Testing Local Data Storage

• Check NSUserDefaults for sensitive data

  ios nsuserdefaults get

• Check plist files for sensitive data
• Analyze SQLite databases for unencrypted data
• Check Core Data stores

MASTG-TEST-0053: Testing the Keychain

• Dump keychain items

  ios keychain dump --json

• Check accessibility levels (kSecAttrAccessible*)
• Verify biometric protection where needed
• Check for overly permissive accessibility

MASTG-TEST-0054: Testing Logs for Sensitive Data

• Check console logs via Xcode
• Check system logs (syslog)
• Verify NSLog statements don't leak data

MASTG-TEST-0055: Testing Backups for Sensitive Data

• Check iTunes backup for sensitive data
• Verify excluded files (NSURLIsExcludedFromBackupKey)
• Test iCloud backup content

MASTG-TEST-0056: Testing Memory for Sensitive Data

• Dump process memory
• Search for credentials in memory
• Check memory after logout

MASTG-TEST-0057: Testing the Clipboard

• Monitor pasteboard for sensitive data

  ios pasteboard monitor

• Check UIPasteboard usage
• Verify clipboard clearing

MASTG-TEST-0058: Testing Keyboard Cache

• Check keyboard autocorrect data
• Verify secureTextEntry for passwords
• Check custom keyboard restrictions

MASVS-CRYPTO: Cryptography

MASTG-TEST-0059: Testing Cryptographic APIs

• Hook crypto operations

  frida -U app -l crypto_hooks.js

• Check for weak algorithms (DES, RC4, MD5)
• Verify proper key lengths
• Check for ECB mode usage

MASTG-TEST-0060: Testing Random Number Generation

• Check for SecRandomCopyBytes usage
• Verify no arc4random for crypto
• Check for predictable seeds

MASTG-TEST-0061: Testing Key Management

• Check hardcoded keys in binary

  strings App.app/App | grep -i key

• Verify Keychain usage for key storage
• Check key derivation functions

MASVS-AUTH: Authentication

MASTG-TEST-0062: Testing Local Authentication

• Test biometric bypass

  frida -U app -l biometric_bypass.js

• Check LAContext implementation
• Verify server-side validation
• Test fallback mechanisms

MASTG-TEST-0063: Testing Session Management

• Check session token storage
• Verify token expiration
• Test session invalidation on logout
• Check for session fixation

MASTG-TEST-0064: Testing OAuth Implementation

• Check PKCE implementation
• Verify state parameter usage
• Test token storage security

MASVS-NETWORK: Network Communication

MASTG-TEST-0065: Testing Network Communication

• Bypass SSL pinning

  ios sslpinning disable

• Intercept HTTPS traffic
• Check for HTTP usage
• Verify certificate validation

MASTG-TEST-0066: Testing SSL Pinning

• Identify pinning implementation
• Test bypass methods
• Verify pinning on all endpoints

MASTG-TEST-0067: Testing Custom Certificate Stores

• Check for custom trust anchors
• Verify CA certificate handling
• Test with self-signed certificates

MASTG-TEST-0068: Testing App Transport Security

• Check Info.plist for ATS exceptions
• Verify NSAllowsArbitraryLoads = NO
• Check domain-specific exceptions

MASVS-PLATFORM: Platform Interaction

MASTG-TEST-0069: Testing App Permissions

• Review Info.plist permissions
• Verify permission justification
• Check runtime permission handling

MASTG-TEST-0070: Testing Universal Links

• Check apple-app-site-association
• Test link handling security
• Verify domain validation

MASTG-TEST-0071: Testing URL Schemes

• Identify custom URL schemes

  plutil -p Info.plist | grep CFBundleURLSchemes

• Test for URL injection
• Check input validation

MASTG-TEST-0072: Testing WebView Security

• Check WKWebView configuration
• Test JavaScript bridge security
• Verify content validation
• Check for XSS vulnerabilities

MASTG-TEST-0073: Testing App Extensions

• Review extension permissions
• Check data sharing security
• Verify extension isolation

MASTG-TEST-0074: Testing UIPasteboard

• Check paste operations
• Verify expiration settings
• Test cross-app access

MASVS-CODE: Code Quality

MASTG-TEST-0075: Testing Binary Protections

• Check PIE flag

  otool -hv App.app/App | grep PIE

• Verify ARC usage

  otool -I -v App.app/App | grep objc_release

• Check stack canaries

  otool -I -v App.app/App | grep stack_chk

MASTG-TEST-0076: Testing Code Signing

• Verify code signature

  codesign -dvv App.app

• Check entitlements
• Verify provisioning profile

MASTG-TEST-0077: Testing for Injection Flaws

• Test SQL injection in local DBs
• Check for format string vulnerabilities
• Test XML/JSON injection

MASTG-TEST-0078: Testing for Sensitive Functionality Exposure

• Review exported methods
• Check for debugging interfaces
• Verify no test code in production

MASVS-RESILIENCE: Anti-Tampering

MASTG-TEST-0079: Testing Jailbreak Detection

• Identify detection methods
• Test bypass effectiveness

  ios jailbreak disable

• Verify multiple detection vectors

MASTG-TEST-0080: Testing Anti-Debugging

• Check for ptrace usage
• Test sysctl detection
• Verify debugger detection

MASTG-TEST-0081: Testing File Integrity Checks

• Check for signature verification
• Test modified binary behavior
• Verify checksum validation

MASTG-TEST-0082: Testing Runtime Integrity Checks

• Check for hook detection
• Test Frida detection
• Verify Substrate detection

MASTG-TEST-0083: Testing Obfuscation

• Analyze binary for obfuscation
• Check class/method naming
• Review string encryption

Quick Reference

Critical Findings (Immediate Risk)

• Hardcoded credentials in binary
• Plaintext sensitive data in storage
• Missing SSL pinning on auth endpoints
• Biometric bypass without server validation
• kSecAttrAccessibleAlways for sensitive data

High Priority

• Weak encryption algorithms
• Sensitive data in logs
• Missing binary protections
• Insecure URL scheme handling
• Weak session management

Medium Priority

• Missing certificate pinning
• Keyboard cache enabled
• Clipboard sensitive data
• ATS exceptions
• Weak jailbreak detection