skilld
All skills
hardw00t avatar

/ios-pentest

@f9bb3b2
by Hardik Mehtahardw00t/ai-security-arsenal104 stars
15

iOS mobile application penetration testing with Frida and Objection on jailbroken or non-jailbroken devices. Use for static + dynamic analysis of IPAs, SSL pinning / jailbreak / biometric bypass, keychain & local-storage extraction, network interception, and OWASP MASTG iOS assessments. Triggers on requests to pentest iOS apps, analyze IPAs, bypass iOS security controls, or produce MASTG-aligned findings.

Ask your Agent

Use this Skill: https://skilld.dev/gh/hardw00t/ai-security-arsenal/ios-pentest

This session only. Nothing lands on disk.

methodologynetwork_testing.md

≈425 tokens on demand. Your agent reads this file only when SKILL.md points to it.

Methodology: iOS Network Testing

Proxy Setup

  1. Burp on host, listener 0.0.0.0:8080, invisible proxying off for first pass.
  2. On device: Settings > Wi-Fi > (i) > Configure Proxy > Manual > <host>:8080.
  3. Export Burp CA (DER), host it via python3 -m http.server, download on Safari, install profile.
  4. Settings > General > About > Certificate Trust Settings > enable Burp root.

Validating Interception

# From the device's Safari: hit https://example.com — if pinning not in play you see it in Burp.
# If the target app's traffic is absent, SSL pinning is likely — run workflows/ssl_pinning_bypass.md.

Traffic Classification

  • HTTP/1.1 & HTTP/2 over TLS → Burp handles natively.
  • WebSockets → visible under Proxy > WebSockets history.
  • gRPC over HTTP/2 → Burp 2024+ decodes; use the gRPC extension.
  • QUIC/HTTP3 → Burp does not intercept. Block UDP/443 at the proxy host to force TCP fallback.

ATS (App Transport Security) Review

plutil -p App.app/Info.plist | grep -A20 NSAppTransportSecurity

Findings: NSAllowsArbitraryLoads=YES, per-domain NSExceptionAllowsInsecureHTTPLoads=YES, low NSExceptionMinimumTLSVersion.

Certificate Pinning Inventory

  • NSURLSession delegate URLSession:didReceiveChallenge:completionHandler:.
  • AFNetworking AFSecurityPolicy.
  • TrustKit (TSKPinningValidator).
  • Alamofire ServerTrustManager.
  • Raw BoringSSL / OpenSSL inside a static lib. Find via class-dump + grep -iE 'trust|pin'.

Attack Paths

  • Mixed content in WKWebView (HTTP subresources with ATS exception).
  • URL scheme-based open redirect.
  • Missing HSTS on API responses.
  • Tokens in query string (logged in CDN/proxy).

Source: SKILL.md on GitHub

Third-party checks

2 alerts16d4 checks · Risk CRITICAL
  • Gen Agent Trust Hub16d

    iOS penetration testing toolkit for security professionals. The skill provides methodologies, workflows, and Frida scripts for analyzing mobile applications on jailbroken or stock devices. It utilizes standard industry tools and well-known community repositories for its tasks.

  • Socket16d

    11 alerts: gptSecurity, gptAnomaly

  • Snyk16d

    Risk: LOW · No issues

  • Runlayer7mo

    3/9 files flagged

Provenance

Signed by skilld at f9bb3b2. This ties the file your Agent reads to that commit on GitHub. It does not review the instructions.

Last checked against GitHub 2 months ago.

Steadyupdated 6 months ago

README badge

README badge for hardw00t/ai-security-arsenal/ios-pentest