iOS application penetration testing

An app being on the App Store does not mean it is secure. We audit your iOS application following the OWASP MASVS methodology to detect vulnerabilities in data, communications and business logic.

Why do iOS apps need a dedicated assessment?

Apple's review catches malware and policy violations, but it does not audit your application's security logic. Data stored unencrypted in the keychain, session tokens exposed in logs, disabled certificate validation or insecure communications with backends are vulnerabilities Apple does not review and that an attacker with the device in hand can exploit.

Scope

  • Static analysis: reversing of the IPA binary, code analysis with Frida/objection
  • Insecure storage: Keychain, NSUserDefaults, files, SQLite, CoreData
  • Communications: TLS certificate validation, certificate pinning, intercepted traffic
  • Authentication and session management in the app and its API
  • Binary protection: jailbreak detection, anti-tampering, anti-debugging
  • Business logic: in-app payments, permissions, access to sensitive data
  • Privacy: iOS permissions, access to camera/microphone/location/contacts
  • Aligned with OWASP MASVS 2.0 and OWASP MASTG (Mobile Application Security Testing Guide)

Methodology

  1. Static analysis: Decompile and analyse the IPA binary to identify hardcoded secrets, use of insecure APIs and vulnerable code patterns.
  2. Dynamic analysis: Instrumentation of the running process with Frida for function hooking, bypassing security controls and analysing behaviour in real time.
  3. Network assessment: Intercept and analyse all communication between the app and its backends through a proxy (Burp Suite) with certificate pinning bypass.
  4. Local data analysis: Full inspection of the device's local storage: Keychain, backups, temporary files and databases.
  5. MASVS report: Classification of findings by MASVS-L1/L2 levels, with evidence and specific recommendations for the iOS team.

Deliverables

  • Executive report with an MASVS security score
  • Technical report with a PoC for each vulnerability
  • Classification by OWASP MASVS 2.0 categories
  • Code recommendations for the iOS development team
  • Re-test included once fixes have been applied

Use cases

  • Fintech or payment apps that handle sensitive financial data
  • Health applications with users' medical data
  • Enterprise apps with access to corporate systems (MDM, VPN, email)
  • Startups that need to pass investors' security due diligence
  • Companies with PCI-DSS or HIPAA compliance requirements

Frequently asked questions

Do you need the source code or just the IPA?

We can work with just the IPA (black/grey box). If you provide the source code, the analysis is deeper and more efficient. We recommend code access for development teams that want actionable results.

Does the test require a physical jailbroken device?

For full dynamic analysis, yes, we recommend a jailbroken device. We can also work with simulators for part of the static and network analysis.

Do you cover the backend API the app uses?

Yes, we include the assessment of the backend API within the scope of the mobile pentest. It is essential for a complete assessment, as many vulnerabilities live in the server layer.