ios.md

iOS Penetration Testing

Prerequisites

• Jailbroken ios device
  • checkra1n
  • unc0ver
  • chimera
• Tools
  • Burp Suite
  • Mobile Assistant
  • Frida
  • FireCat
  • Cycript
  • Grapefruit
  • Needle
  • iRET
  • Clutch
  • iDB
  • BinaryCookieReader
  • iSpy
  • iWep Pro

Table of contents

• Jailbreak
• Burp Suite
  • Bypass SSL pinning
  • Install CA certificate
• Burp Mobile Assistant

Jailbreak

• checkra1n (A7-A11, up to latest iOS)
• unc0ver (All devices, iOS 11.0 - 13.5)
• odyssey (All devices, iOS 13.0 - 13.7)
• fugu (A10-A10X, iOS 13 - 13.5.1)
• chimera (All devices, iOS 12.0 — 12.5)
• rootlessJB4 (A7-A11, iOS 12.0 - 12.4.8)
• electra (All devices, iOS 11.0 – 11.4.1)

Burp Suite

Bypass SSL pinning

• Cydia dependencies
  • Debian Packager
  • Cydia Substrate
  • PreferenceLoader
• Download latest release of ssl-kill-switch2
  • https://github.com/nabla-c0d3/ssl-kill-switch2/releases
• Install

dpkg -i <package>.deb
killall -HUP SpringBoard

Install CA certificate

• Turn on burp proxy
• Configure Wifi proxy settinngs
• http://burp
• Install certificate

Mobile Assistant

• https://portswigger.net/burp/documentation/desktop/tools/mobile-assistant/installing
• enable Burp proxy on all interfaces
• add as a source to cydia and install mobile assistant