> For the complete documentation index, see [llms.txt](https://chinnidiwakar.gitbook.io/githubimport/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://chinnidiwakar.gitbook.io/githubimport/mobile-apps-pentesting/ios-pentesting-checklist.md).

# iOS Pentesting Checklist

If you want to **know** about my **latest modifications**/**additions** or you have **any suggestion for HackTricks or PEASS**, **join the** [**💬**](https://emojipedia.org/speech-balloon/) [**PEASS & HackTricks telegram group here**](https://t.me/peass), or **follow me on Twitter** [🐦](https://emojipedia.org/bird/)[**@carlospolopm**](https://twitter.com/carlospolopm)**.**\
If you want to **share some tricks with the community** you can also submit **pull requests** to **\*\*\[**<https://github.com/carlospolop/hacktricks**](https://github.com/carlospolop/hacktricks>) **\*\*that will be reflected in this book.**\
**Don't forget to** give ⭐ on the github\*\* to motivate me to continue developing this book.

## Preparation

* [ ] Read [**iOS Basics**](/githubimport/mobile-apps-pentesting/ios-pentesting/ios-basics.md)\*\*\*\*
* [ ] Prepare your environment reading **\*\*\[**&#x69;OS Testing Environmen&#x74;*\*]\(ios-pentesting/ios-testing-environment.md)\\*\*\*\*
* [ ] Read all the sections of **\*\*\[**&#x69;OS Initial Analysi&#x73;**]\(ios-pentesting/#initial-analysis) \*\***&#x74;o learn common actions to pentest an iOS application

## Data Storage

* [ ] [**Plist files**](/githubimport/mobile-apps-pentesting/ios-pentesting.md#plist) can be used to store sensitive information.
* [ ] \*\*\*\*[**Core Data**](/githubimport/mobile-apps-pentesting/ios-pentesting.md#core-data) (SQLite database) can store sensitive information.
* [ ] \*\*\*\*[**YapDatabases**](/githubimport/mobile-apps-pentesting/ios-pentesting.md#yapdatabase) (SQLite database) can store sensitive information.
* [ ] \*\*\*\*[**Firebase**](/githubimport/mobile-apps-pentesting/ios-pentesting.md#firebase-real-time-databases) miss-configuration.
* [ ] \*\*\*\*[**Realm databases**](/githubimport/mobile-apps-pentesting/ios-pentesting.md#realm-databases) can store sensitive information.
* [ ] \*\*\*\*[**Couchbase Lite databases**](/githubimport/mobile-apps-pentesting/ios-pentesting.md#couchbase-lite-databases) can store sensitive information.
* [ ] \*\*\*\*[**Binary cookies**](/githubimport/mobile-apps-pentesting/ios-pentesting.md#cookies) can store sensitive information
* [ ] \*\*\*\*[**Cache data**](/githubimport/mobile-apps-pentesting/ios-pentesting.md#cache) can store sensitive information
* [ ] \*\*\*\*[**Automatic snapshots**](/githubimport/mobile-apps-pentesting/ios-pentesting.md#snapshots) can save visual sensitive information
* [ ] \*\*\*\*[**Keychain**](/githubimport/mobile-apps-pentesting/ios-pentesting.md#keychain) is usually used to store sensitive information that can be left when reselling the phone.
* [ ] In summary, just **check for sensitive information saved by the application in the filesystem**

## Keyboards

* [ ] Does the application [**allow to use custom keyboards**](/githubimport/mobile-apps-pentesting/ios-pentesting.md#custom-keyboards-keyboard-cache)?
* [ ] Check if sensitive information is saved in the [**keyboards cache files**](/githubimport/mobile-apps-pentesting/ios-pentesting.md#custom-keyboards-keyboard-cache)\*\*\*\*

## **Logs**

* [ ] Check if [**sensitive information is being logged**](/githubimport/mobile-apps-pentesting/ios-pentesting.md#logs)\*\*\*\*

## Backups

* [ ] \*\*\*\*[**Backups**](/githubimport/mobile-apps-pentesting/ios-pentesting.md#backups) can be used to **access the sensitive information** saved in the file system (check the initial point of this checklist)
* [ ] Also, [**backups**](/githubimport/mobile-apps-pentesting/ios-pentesting.md#backups) can be used to **modify some configurations of the application**, then **restore** the backup on the phone, and the as the **modified configuration** is **loaded** some (security) **functionality** may be **bypassed**

## **Applications Memory**

* [ ] Check for sensitive information inside the [**application's memory**](/githubimport/mobile-apps-pentesting/ios-pentesting.md#testing-memory-for-sensitive-data)\*\*\*\*

## **Broken Cryptography**

* [ ] Check if yo can find [**passwords used for cryptography**](/githubimport/mobile-apps-pentesting/ios-pentesting.md#broken-cryptography)\*\*\*\*
* [ ] Check for the use of [**deprecated/weak algorithms**](/githubimport/mobile-apps-pentesting/ios-pentesting.md#broken-cryptography) to send/store sensitive data
* [ ] \*\*\*\*[**Hook and monitor cryptography functions**](/githubimport/mobile-apps-pentesting/ios-pentesting.md#broken-cryptography)\*\*\*\*

## **Local Authentication**

* [ ] If a [**local authentication**](/githubimport/mobile-apps-pentesting/ios-pentesting.md#local-authentication) is used in the application, you should check how the authentication is working.
  * [ ] If it's using the [**Local Authentication Framework**](/githubimport/mobile-apps-pentesting/ios-pentesting.md#local-authentication-framework) it could be easily bypassed
  * [ ] If it's using a [**function that can dynamically bypassed**](/githubimport/mobile-apps-pentesting/ios-pentesting.md#local-authentication-using-keychain) you could create a custom frida script

## Sensitive Functionality Exposure Through IPC

* \*\*\*\*[**Custom URI Handlers / Deeplinks / Custom Schemes**](/githubimport/mobile-apps-pentesting/ios-pentesting.md#custom-uri-handlers-deeplinks-custom-schemes)\*\*\*\*
  * [ ] Check if the application is **registering any protocol/scheme**
  * [ ] Check if the application is **registering to use** any protocol/scheme
  * [ ] Check if the application **expects to receive any kind of sensitive information** from the custom scheme that can be **intercepted** by the another application registering the same scheme
  * [ ] Check if the application **isn't checking and sanitizing** users input via the custom scheme and some **vulnerability can be exploited**
  * [ ] Check if the application **exposes any sensitive action** that can be called from anywhere via the custom scheme
* \*\*\*\*[**Universal Links**](/githubimport/mobile-apps-pentesting/ios-pentesting.md#universal-links)\*\*\*\*
  * [ ] Check if the application is **registering any universal protocol/scheme**
  * [ ] Check the **`apple-app-site-association`** file
  * [ ] Check if the application **isn't checking and sanitizing** users input via the custom scheme and some **vulnerability can be exploited**
  * [ ] Check if the application **exposes any sensitive action** that can be called from anywhere via the custom scheme
* \*\*\*\*[**UIActivity Sharing**](/githubimport/mobile-apps-pentesting/ios-pentesting/ios-uiactivity-sharing.md)\*\*\*\*
  * [ ] Check if the application can receive UIActivities and if it's possible to exploit any vulnerability with specially crafted activity
* \*\*\*\*[**UIPasteboard**](/githubimport/mobile-apps-pentesting/ios-pentesting/ios-uipasteboard.md)\*\*\*\*
  * [ ] Check if the application if **copying anything to the general pasteboard**
  * [ ] Check if the application if **using the data from the general pasteboard for anything**
  * [ ] Monitor the pasteboard to see if any **sensitive data is copied**
* \*\*\*\*[**App Extensions**](/githubimport/mobile-apps-pentesting/ios-pentesting/ios-app-extensions.md)\*\*\*\*
  * [ ] Is the application **using any extension**?
* [**WebViews**](/githubimport/mobile-apps-pentesting/ios-pentesting/ios-webviews.md)\*\*\*\*
  * [ ] Check which kind of webviews are being used
  * [ ] Check the status of **`javaScriptEnabled`**, **`JavaScriptCanOpenWindowsAutomatically`**, **`hasOnlySecureContent`**
  * [ ] Check if the webview can **access local files** with the protocol **file://** **(**`allowFileAccessFromFileURLs`, `allowUniversalAccessFromFileURLs`)
  * [ ] Check if Javascript can access **Native** **methods** (`JSContext`, `postMessage`)

## Network Communication

* [ ] Perform a [**MitM to the communication**](/githubimport/mobile-apps-pentesting/ios-pentesting.md#network-communication) and search for web vulnerabilities.
* [ ] Check if the [**hostname of the certificate**](/githubimport/mobile-apps-pentesting/ios-pentesting.md#hostname-check) is checked
* [ ] Check/Bypass [**Certificate Pinning**](/githubimport/mobile-apps-pentesting/ios-pentesting.md#certificate-pinning)\*\*\*\*

## **Misc**

* [ ] Check for [**automatic patching/updating**](/githubimport/mobile-apps-pentesting/ios-pentesting.md#hot-patching-enforced-updateing) mechanisms
* [ ] Check for [**malicious third party libraries**](/githubimport/mobile-apps-pentesting/ios-pentesting.md#third-parties)\*\*\*\*