About Course
iOS Pentesting Course: Hack iPhone Apps for Bug Bounty
IOS Penetration Testing (Bug Bounty) is the iOS pentesting course from TMG Security that teaches you how to find security bugs in iPhone and iPad apps. You set up a testing lab, learn jailbreaking, extract and analyse IPAs, and bypass jailbreak detection and SSL pinning with tools like Frida and Objection. In addition, you study real HackerOne reports and hunt bugs in real-world iOS applications.
- OWASP Mobile Top 10 2024
- Static + dynamic analysis
- Frida & Objection
- Live attack PoCs
- Beginner friendly
Description
This course introduces students to the IOS Pentesting & IOS Bug Bounty concepts associated with IOS application pentesting. We encourage you to take this course if you are a complete beginner in IOS bug bounty world. This course uses a custom-developed on Real World IOS application pentesting to demonstrate how, web vulnerabilities can be identified and exploited. This course teaches you how to identify a variety of IOS vulnerabilities lies in the Server-side, Client-side.
Requirements:
-
The course starts from basics, however, it is good to have basic knowledge of Web applications, API Pentesting & Android pen-testing.
Topics:
Introduction & Setting up your environment
- Mobexler OS
- Using MacOS on a Windows Machine
- Simulators and Emulators
- Jailbreaking and its Types
- Jailbreak iOS 15,16,17 devices
- Capturing HTTP Requests from an iOS device!
Introduction to iOS file Structure
- Introduction to iOS Applications
- All about Info .plist files
- Discovering UDID
- iPhone Shell
- Transferring data between iPhones and PC
- Extracting and Decrypting IPAs
- Sideloading iOS Applications
- iOS Data Protection
- iOS Keychain
- iOS App Capabilities and Purpose Strings
OWASP Mobile TOP 10 2024
- What is OWASP?
- M1: Improper Credential Usage
- M2: Inadequate Supply Chain Security
- M3: Insecure Authentication/Authorization
- M4: Insufficient Input/Output Validation
- M5: Insecure Communication
- M6: Inadequate Privacy Controls
- M7: Insufficient Binary Protections
- M8: Security Misconfiguration
- M9: Insecure Data Storage
- M10: Insufficient Cryptography
Static Analysis
- Automatic Static Analysis using MobSF
- FileSystem Analysis
- App Logs Analysis
- Hardcoded Credentials
- Database Analysis
- Keychain Analysis
- Pasteboard Analysis
- WebViews Analysis
- Applications Memory Analysis
- Insecure APIs/Functions Analysis
- Reverse Engineering using iRET
- Reverse Engineering using Hopper
Dynamic Analysis
- Tweaks, Cydia/Sileo, Substitute
- Installing Tweaks
- Installing Frida
- Jailbreak Detection
- Jailbreak Detection Bypass using Frida
- Jailbreak Detection Bypass using Shadow
- Jailbreak Detection Bypass using Liberty
- Jailbreak Detection Bypass using A-Bypass
- Jailbreak Detection Bypass using Objection
- Jailbreak Detection other Utilites
- SSL Pinning
- SSL Pinning Bypass using Frida
- SSL Pinning Bypass using SSL Kill Swtich
- SSL Pinning Bypass using Objection
- TouchID/FaceID Bypass
- iOS Security Framework iNalyzer
- Simple iOS app blackbox assessment tool – Passionfruit
- Objection Framework and its commands!
- Blackbox tool Introspy
- Dump Keychain Values – keychaindumper
- Read Cookies – BinaryCookieReader
- Load desired View Controller – Scwapper
- Solving Vulnerable Application – iGoat & DVIA
Multiple Live Attack PoCs
Learning from iOS Hacker one Reports
Tips & Tricks & Doubts
- IOS Pentesting Checklist
- Setting up your custom Methodology
- How to create your own Nuclei templates for iOS Pentesting Nuclei
- Using Objection and Frida without Jailbreaking the device
- IOS Frida Scripts
IOS Bug Bounty Hunting on Real World Applications
- Live IOS Bug Bounty Targets Hunting
Benefits :
- Get ISO Certified Certification
Why choose this iOS pentesting course?
Complete lab setup
First, build your iOS testing environment with Mobexler, simulators and jailbroken devices, even if you use a Windows machine.
Mapped to OWASP
Every bug class follows the OWASP Mobile Top 10 2024, from insecure storage to weak cryptography.
Static analysis
Analyse file systems, logs, databases, the keychain, WebViews and memory, then reverse engineer the app binary.
Dynamic analysis
Next, bypass jailbreak detection, SSL pinning and Touch ID or Face ID checks with Frida, Objection and other tools.
Learn from real reports
Study disclosed iOS HackerOne reports to see exactly which mobile bugs programs pay for.
Bug bounty focused
Finally, hunt bugs in real-world iOS applications. Bug bounty is our USP, so the course ends with real targets.
Who should take this iOS hacking course?
- Bug bounty hunters who want to add mobile apps to their scope.
- Web pentesters who want to move into mobile application security.
- Beginners, since the course starts from the basics of iOS.
- iOS developers who want to secure their own apps.
Testing Android apps too? Take our Android Pentesting course, browse all TMG Security cybersecurity courses, or book one-to-one mobile security training.
iOS pentesting course FAQ
Is this iOS pentesting course good for beginners?
Yes. The course starts from the basics, so complete beginners in iOS bug bounty can follow along before moving to advanced attacks.
Do I need a Mac or an iPhone?
Not necessarily. The course shows how to use macOS on a Windows machine, along with simulators, emulators and Mobexler OS for testing.
Does the course cover jailbreaking?
It does. You learn the types of jailbreak and how to jailbreak iOS 15, 16 and 17 devices for testing.
Will I learn SSL pinning and jailbreak detection bypass?
Absolutely. You will bypass both using Frida, Objection and other tools, plus Touch ID and Face ID checks.
Can I use this iOS pentesting course for bug bounty?
Yes. The iOS pentesting course covers real HackerOne reports and ends with bug bounty hunting on real-world iOS applications.
Course Content
Introduction to IOS Penetration Testing / Bug Bounty
-
Join IOS Penetration Testing Community Group to Join Live Classes
00:00
