IOSAdvanced

IOS Application Security

An IOS application security course with content, an embedded vphone VNC, live system logs, SSH shell access, and app package upload built into each lesson. Covers IOS internals, userland and kernel exploitation, modern mitigations, fuzzing, and real-world case studies.

VBD

25 sections136 lessons26 labs91h

Get Access Sign Up Free

Course Curriculum

25 sections · 136 lessons

iOS Security Architecture & Threat Model7 lessons

The iOS stack: XNU kernel, Secure Enclave (SEP), hardware security model

PreviewTheory

iOS - Lab Setup & The iOS Toolkit8 lessons

Your in-browser jailbroken iPhone and AttackBox: how they connect

Theory

Device interaction: SSH, libimobiledevice, iproxy

Theory

On-device tooling: Sileo, TrollStore, frida-server, debug server

Theory

The static toolkit: class-dump, Hopper, Ghidra, radare2, MobSF

Theory

The dynamic toolkit: Frida, Objection, Cycript

Theory

Getting apps: IPATool, AnyTrans, downloading IPAs, DVIA practice apps

Theory

Corellium vs. physical device (local reference)

Theory

Lab: SSH into the device, install a practice app, and confirm your toolchain

Lab

iOS - Intro to iOS Apps & Build Your First App6 lessons

Types of iOS apps; identifying Swift vs. Objective-C vs. Flutter vs. React Native

Theory

The Info.plist, app bundle layout, and common iOS app definitions

Theory

Xcode basics: building and running an app

Theory

Decompiling your own app: source, Mach-O, and behavior

Theory

Building a reusable PoC attacker app template

Theory

Lab: Build a simple app, then identify and inspect its bundle on the device

Lab

iOS - IPA Deep Dive, Decryption & Sideloading5 lessons

IPA anatomy and App Store (FairPlay) encryption

Theory

Decrypting installed apps with frida-ios-dump and bfinject

Theory

Sideloading with TrollStore and signing binaries with custom entitlements

Theory

App data and app containers: locating an installed app on the filesystem

Theory

Lab: Decrypt a target App Store app and pull a clean binary

Lab

iOS - Static Analysis & Secret Hunting7 lessons

class-dump and class-dump-z: Objective-C headers and class structure

Theory

Reading Swift and Objective-C binaries in Hopper, Ghidra, and radare2

Theory

Mach-O internals and ARM64 basics for reversing

Theory

Info.plist and entitlement analysis: permissions, ATS exceptions, capabilities

Theory

Identifying attack surface: URL scheme handlers, exported functions, third-party SDKs

Theory

Finding hardcoded secrets and API keys; automated analysis with MobSF; MCP-assisted RE

Theory

Lab: Reverse a target binary and recover its hidden secret and URL schemes

Lab

iOS - App Patching, Re-Signing & LLDB Debugging5 lessons

Patching an iOS application binary and re-signing

Theory

Setting up the remote debug server

Theory

LLDB essentials: breakpoints, registers, memory inspection

Theory

Memory patching with LLDB at runtime

Theory

Lab: Patch a check (binary or in-memory) to unlock a gated flag

Lab

iOS - Network Interception & SSL Pinning Bypass7 lessons

App Transport Security (ATS) and NSAllowsArbitraryLoads

Theory

Routing device traffic through Burp/Proxyman on your AttackBox

Theory

Pinning implementations: TrustKit, NSURLSession, Alamofire — how each works

Theory

Pinning bypass: SSL Kill Switch 2, Objection ssl-unpinning, Frida hooks

Theory

Certificate transparency; intercepting proxy-aware vs. proxy-unaware apps

Theory

Analysing captured API traffic for auth flaws, IDOR, and data leaks

Theory

Lab: Bypass pinning on a target app and pull the flag from its API call

Lab

iOS - Dynamic Instrumentation with Frida7 lessons

Frida architecture; attaching and enumerating classes/methods on jailbroken iOS

Theory

Objective-C method hooks: trace and tamper args/return values

Theory

Swift hooking, Swift-string inspection, and native callbacks (newNativeCallback)

Theory

frida-trace, trace handlers, and the Frida web UI; decrypting apps with Frida

Theory

Cycript and Objection: automated enumeration and runtime inspection

Theory

Hands-on Frida labs: call a different ObjC/Swift function, brute-force a PIN

Lab

Lab: Hook the app to brute-force or bypass a PIN and capture the flag

Lab

iOS - App Data Containers & Insecure Storage5 lessons

iOS app containers: bundle vs. data container layout

Theory

NSUserDefaults, plist files, CoreData, and SQLite databases, caches

Theory

App data container monitoring as the app runs

Theory

Finding sensitive data left in storage

Theory

Lab: Browse a target app's container over SSH and exfiltrate its stored secret

Lab

iOS - Keychain & Data Protection5 lessons

Keychain API internals: kSecAttrAccessible and protection classes

Theory

Data Protection classes and accessibility flags

Theory

Dumping the Keychain with Objection and idb on a jailbroken device

Theory

Verifying MASVS L2 secure-storage requirements

Theory

Lab: Dump the Keychain and recover an app's stored credential flag

Lab

iOS - URL Schemes, Universal Links & Deep Linking5 lessons

Custom URL schemes and scheme hijacking/squatting

Theory

Universal Links and the Apple App Site Association (AASA) file

Theory

Deep-link parameter abuse and unauthorized actions

Theory

Handoff between deep links and WebViews

Theory

Lab: Craft a malicious URL/deep link that drives the app to leak a flag

Lab

iOS - WebViews on iOS5 lessons

WKWebView vs. legacy UIWebView vs. SFSafariViewController

Theory

The JavaScript to native message bridge as an attack surface

Theory

Local file access and stealing app-internal files

Theory

Cross-site scripting in WebViews and insecure content loading

Theory

Lab: Exploit a vulnerable WebView to exfiltrate an app-private file flag

Lab

iOS - iOS IPC: XPC, App Extensions, App Groups & Pasteboard6 lessons

XPC services and Mach IPC as an attack surface

Theory

App Extensions (share/action/keyboard) and their trust boundaries

Theory

App Groups and shared container data leakage

Theory

Pasteboard (general pasteboard) abuse between apps

Theory

Push notifications (APNs) and Siri Shortcuts/App Intents surface

Theory

Lab: Abuse a shared App Group/XPC interface to reach another app's data flag

Lab

iOS - Broken Cryptography5 lessons

Common iOS crypto failures: ECB, static IVs, hardcoded keys, weak KDFs

Theory

CommonCrypto/CryptoKit misuse and Keychain-backed keys

Theory

Automated crypto-analysis tooling

Theory

Recovering keys and plaintext with Frida hooks on crypto APIs

Theory

Lab: Hook the app's decryption routine to recover an encrypted flag

Lab

iOS - Authentication & Biometrics5 lessons

LocalAuthentication (LAContext) and the biometric prompt flow

Theory

Runtime biometric/Face ID/Touch ID bypass with Frida

Theory

Insecure local authentication and broken access-control patterns

Theory

Secure (Keychain-gated) vs. insecure biometric implementations

Theory

Lab: Bypass a biometric gate with Frida to reach a protected screen flag

Lab

iOS - Side-Channel & Privacy Attacks5 lessons

Sensitive data leakage via device logs

Theory

Pasteboard leakage between apps

Theory

App snapshot (backgrounding) analysis and FLAG_SECURE-equivalent gaps

Theory

Keyboard cache and autofill leakage

Theory

Lab: Capture a secret leaked into logs/snapshots when the app backgrounds

Lab

iOS - Cross-Platform Apps: Flutter & React Native5 lessons

Identifying Flutter and React Native apps on iOS

Theory

Flutter: traffic interception, symbolicating Dart, runtime manipulation

Theory

Flutter/RN TLS-bypass techniques (reFlutter and friends)

Theory

React Native: unpacking and reading the JS bundle

Theory

Lab: Intercept a Flutter app's traffic and recover its hidden API flag

Lab

iOS - Advanced Frida Tracing & Real-App Analysis5 lessons

Tracing real IM apps (Telegram/Signal-style) in Objective-C and Swift

Theory

Strategy for large, stripped Swift binaries

Theory

Building reusable Frida tracing scripts and startup hooks

Theory

Combining static and dynamic analysis for fast triage

Theory

Lab: Trace a target messaging app to expose a hidden runtime value

Lab

iOS - Jailbreak Detection & Anti-Debugging Bypass4 lessons

Jailbreak detection techniques explained

Theory

Bypassing jailbreak detection with LLDB, Frida, and detection-bypass tweaks

Theory

Anti-debugging (ptrace, sysctl, inline-asm) and bypasses

Theory

Lab: Defeat a layered jailbreak + anti-debug gate to run the app

Lab

iOS - Anti-Reversing & Anti-Fraud Techniques5 lessons

Device fingerprinting and how it's built

Theory

Detecting (and defeating) emulated locations

Theory

Detecting Frida hooking, proxies, and VPNs — and bypassing each

Theory

Jailbreak/RASP detection at scale; call-detection fraud prevention

Theory

Lab: Bypass an anti-fraud stack (Frida + proxy + location checks) to proceed

Lab

iOS - Apple's Enhanced Security & Lockdown Mode5 lessons

Apple's Enhanced Security for apps: enabling and checking for it

Theory

Lockdown Mode and BlastDoor: what they shut down

Theory

Memory Integrity and pointer-authentication context (high level)

Theory

How these features change app testing and attack surface

Theory

Lab: Check a target app for Enhanced Security and document the impact

Lab

iOS - OWASP MASVS, MASTG & the Mobile Top 105 lessons

The OWASP Mobile Top 10 (M1–M10), mapped to this path's modules

Theory

OWASP MASVS: the mobile app security verification standard

Theory

OWASP MASTG: structured testing procedures and the iOS test checklist

Theory

Producing a standards-aligned assessment

Theory

Lab: Run a MASTG iOS checklist pass against a target app

Lab

iOS - Automation in iOS Pentesting4 lessons

Automated static and dynamic tooling for iOS

Theory

Chaining decrypt → class-dump → scan → report

Theory

Reusable Objection/Frida scripts and startup automation

Theory

Lab: Run an automated first-pass assessment and review the findings

Lab

iOS - Bug Bounty Methodology & Reporting5 lessons

iOS bug-bounty scope and program types

Theory

Breadth-first triage vs. depth-first deep-dives

Theory

Building a clean PoC and demonstrating impact

Theory

Writing reports that get accepted (and paid)

Theory

Lab: Run a structured triage on a target app and draft a finding

Lab

iOS - Capstone: Full iOS App Assessment5 lessons

Brief: one target app, one objective, no walkthrough

Theory

Decrypt → static recon → dynamic attack

Theory

Defeat pinning/jailbreak-detection → exploit the chain → exfiltrate

Theory

Document the full kill chain in a MASTG-aligned professional report

Theory

Lab: Complete the capstone and submit your assessment report

Lab

Full access requires enrollment

Labs, theory lessons, videos, and progress tracking are available after getting access.

Get Access Create Free Account