analyzing-ios-app-security-with-objection

Files (8)

• LICENSE
• SKILL.md
• template.md · assets/
• api-reference.md · references/
• standards.md · references/
• workflows.md · references/
• agent.py · scripts/
• process.py · scripts/

SKILL.md (first lines)

# Analyzing iOS App Security with Objection

## When to Use

Use this skill when:
- Performing runtime security assessment of iOS applications during authorized penetration tests
- Inspecting iOS keychain, filesystem, and memory for sensitive data exposure
- Bypassing client-side security controls (SSL pinning, jailbreak detection) during security testing
- Evaluating iOS app behavior at runtime without access to source code

**Do not use** this skill on production devices without explicit authorization -- Objection modifies app runtime behavior and may trigger security monitoring.

## Prerequisites

- Python 3.10+ with pip
- Objection installed: `pip install objection`
- Frida installed: `pip install frida-tools`
- Target iOS device (jailbroken with Frida server, or non-jailbroken with repackaged IPA)
- For non-jailbroken: `objection patchipa` to inject Frida gadget into IPA
- macOS recommended for iOS testing (Xcode, ideviceinstaller)
- USB connection to target device or network Frida server

## Workflow

### Step 1: Prepare the Testing Environment

**For jailbroken devices:**
```bash
# Install Frida server on device via Cydia/Sileo
# SSH to device and start Frida server
ssh root@<device_ip> "/usr/sbin/frida-server -D"

# Verify Frida connectivity
frida-ps -U  # List processes on USB-connected device
```

**For non-jailbroken devices (authorized testing):**
```bash
# Patch IPA with Frida gadget
objection patchipa --source target.ipa --codesign-signature "Apple Development: test@example.com"

# Install patched IPA
ideviceinstaller -i target-patched.ipa
```

### Step 2: Attach Objection to Target App

```bash
# Attach to running app by bundle ID
objection --gadget "com.target.app" explore

# Or spawn the app fresh
objection --gadget "com.target.app" explore --startup-command "ios hooking list classes"
```

Once attached, Objection provides an interactive REPL for runtime exploration.

### Step 3: Assess Data Storage Security (MASVS-STORAGE)

```bash
# Dump iOS Keychain items accessible to the app
ios keychain dump

# List files in app sandbox
ios plist cat Info.plist
env  # Show app environment paths

# Inspect NSUserDefaults for sensitive data
ios nsuserdefaults get

# List SQLite databases
sqlite connect app_data.db
sqlite execute query "SELECT * FROM credentials"

# Check for sensitive data in pasteboard
ios pasteboard monitor
```

### Step 4: Evaluate Network Security (MASVS-NETWORK)

```bash
# Disable SSL/TLS certificate pinning
ios sslpinning disable

# Verify pinning is bypassed by observing traffic in Burp Suite proxy
# Monitor network-related class method calls
ios hooking watch class NSURLSession
ios hooking watch class NSURLConnection
```

### Step 5: Inspect Authentication and Authorization (MASVS-AUTH)

```bash
# List all Objective-C classes
ios hooking list classes

# Search for authentication-related classes
ios hooking search classes Auth
ios hooking search classes Login
ios hooking search classes Token

# Hook authentication methods to observe parameters
ios hooking watch method "+[AuthManager validateToken:]" --dump-args --dump-return

# Monitor biometric authentication calls
ios hooking watch class LAContext
```

### Step 6: Assess Binary Protections (MASVS-RESILIENCE)

```bash
# Check jailbreak detection implementation
ios jailbreak disable

# Simulate jailbreak detection bypass
ios jailbreak simulate

# List loaded frameworks and libraries
memory list modules

From mukul975/Anthropic-Cybersecurity-Skills, Apache-2.0.

More from mukul975/Anthropic-Cybersecurity-Skills