IOS Application Security Testing Cheat Sheet

Source: Internet
Author: User
Tags ssl certificate

IOS Application Security testing Cheat Sheet
[Hide]
  • 1 DRAFT CHEAT sheet-work in PROGRESS
  • 2 Introduction
  • 3 information gathering
  • 4 Application Traffic analysis
  • 5 Runtime Analysis
  • 6 Insecure Data storage
  • 7 Tools
  • 8 related articles
  • 9 Authors and Primary Editors
  • Ten other cheatsheets
DRAFT CHEAT sheet-work in PROGRESSIntroduction

This cheat sheet provides a checklist of the tasks to being performed when testing an IOS application.

When assessing a mobile application several areas should is taken into Account:client software, the communication channel And the server side infrastructure.

Testing an IOS application usually requires a jailbroken device. (A device that isn't pose any restrictions on the software that can be installed on it.)

Information gathering
  • Observe application Behavior
  • Determine the application ' s data states (at rest, in transit or on display) and sensitivity
  • Identify Access Methods
  • Identify what frameworks is in use
  • Identify Server side APIs that is in use
  • Identify What protocols is in use
  • Identify other applications or services with which the application interacts
  • Decrypt AppStore binaries:the. IPA is decrypted at runtime by the kernel ' s Mach loader. Cydia has several applications available:crackulous, appcrack and clutch. Also, you can use GDB. The "cryptid" field of the Lc_encryption_info identifies if the application is encrypted or not. Use Otool–l <app name> | Grep–a 4 Lc_encryption_info
  • Determine the architecture the application was compiled for:otool–f <app name> or Lipo-info <app>.
  • Get information about what functions, classes and methods is referenced in the application and in the dynamically loaded Libraries. Use nm <app name>
  • List the dynamic dependencies. Use Otool–l <app name>
  • Dump the load commands for the application. Use Otool–l <app name>
  • Dump the runtime information from the compiled application. Identify each class compiled to the program and its associated methods, instance variables and properties. Use Class-dump-z <app name>. That can is put that into a. h file which can is used later to create hooks for method swizzling or to simply make the Met Hods of the app easier to read.
  • Dump the keychain using Dump_keychain to reveal application specific credentials and passwords if stored in the keychain.

Determine the security features in place:

    • Locate the pie (Position Independent executable)-an app compiled without PIE (using the "–fpie–pie" flag) would load the Executable at a fixed address. Check this using the COMMAND:OTOOL–HV <app name>
    • Stack smashing protection-specify The–fstack-protector-all compiler flag. A "Canary" is placed on the stack to protect the saved base pointer, saved instruction pointer and function arguments. It would be verified upon the function return to see if it had been overwritten. Check this using:otool–i–v <app name> | grep stack. If the application is compiled with the stack smashing protection, undefined symbols would be present: "___stack_chk_fa Il "and" ___stack_chk_guard ".
Application Traffic analysis
    • Analyze error Messages
    • Analyze cacheable Information
    • Transport Layer Security (TLS version; Nsurlrequest object)
    • Attack XML Processors
    • SQL Injection
    • Privacy issues (sensitive information disclosure)
    • Improper session Handling
    • Decisions via untrusted inputs
    • Broken cryptography
    • unmanaged code
    • URL schemes
    • Push Notifications
    • Authentication
    • Authorization
    • Session Management
    • Data Storage
    • Data validation (input, Output)
    • Transport Layer Protection–are The certificates validated, does the application implement Certificate pinning
    • Denial of Service
    • Business logic
    • UDID or MAC ID usage (privacy concerns)
Runtime Analysis
    • disassemble the application (GDB)
    • Analyze File system interaction
    • Use the. h file generated With Class-dump-z to create a method swizzling hooks of some interesting methods to either examine the data as it flow thro Ugh or create a "stealer" app.
    • Analyze the application with a debugger (GDB): Inspecting objects in memory and calling functions and methods; Replaci Ng variables and methods at runtime.
    • investigate Cfstream and Nsstream
    • investigate protocol handlers (Application:openurl-validates the source application that instantiated the URL Reque ST) for Example:try to reconfigure the default landing page for the application using a malicious iframe.
    • Buffer overflows and memory corruption
    • Client Side Injection
    • Runtime Injections
    • have access to sources, test the memory by using Xcode schemes
insecure data storage
    • Investigate log files (plugging the device in and pulling down logs with Xcode organizer)
    • Insecure data storage in Application Folder (Var/mobile/applications), caches, in backups (ITunes)
    • Investigate custom created files
    • Analyze Sqllite Database
    • Investigate Property List Files
    • Investigate file Caching
    • Insecure data storage in keyboard cache
    • Investigate cookies.binarycookies
    • Analyze IOS Keychain (/private/var/keychains/keychain-2.db) –when It's accessible and what information it contains; Data stored in the keychain can is only accessible if the attacker have physical access to the device.
    • Check for sensitive information in snapshots
    • Audit data protection of files and keychain entries (to determine when a keychain item should is readable by an applicatio n Check the Data Protection Accessibility constants)
Tools
Tool Link Description
Mallory Proxy http://intrepidusgroup.com/insight/mallory/ Proxy for Binary protocols
Charles/burp Proxy http://www.charlesproxy.com/;

http://www.portswigger.net/burp/

Proxy for HTTP and HTTPS
OpenSSH http://www.openssh.com/ Connect to the IPhone remotely over SSH
Sqlite3 http://www.sqlite.org/ Sqlite Database Client
GNU Debugger http://www.gnu.org/software/gdb/ For run time analysis & Reverse engineering
Syslogd https://developer.apple.com/library/mac/#documentation/darwin/reference/manpages/man8/syslogd.8.html View IPhone Logs
Tcpdump http://www.tcpdump.org/ Capture network traffic on phone
Otool http://developer.apple.com/library/mac/#documentation/darwin/reference/manpages/man1/otool.1.html Odcctools:otool–object File Displaying tool
Cycript http://www.cycript.org/ A language designed to interact with OBJECTIVE-C classes
SSL Kill Switch Https://github.com/iSECPartners/ios-ssl-kill-switch Blackbox tool to disable SSL Certificate validation-including certificate pinning in Nsurl
Plutil http://scw.us/iPhone/plutil/ To view Plist files
Nm Analysis tool to display the symbol table, which includes names of functions and methods, as well as their load addresses.
Sysctl https://developer.apple.com/library/mac/#documentation/darwin/reference/manpages/man8/sysctl.8.html A utility to read and change kernel state variables
Dump_keychain Https://github.com/emonti/iOS_app_re_tools A utility to dump the keychain
Filemon Http://www.newosxbook.com/files/filemon.iOS Monitor Realtime IOS File system
Filedp http://www.securitylearn.net/2012/10/18/extracting-data-protection-class-from-files-on-ios/ Audits data protection of files
Binarycookiereader http://securitylearn.net/wp-content/uploads/tools/iOS/BinaryCookieReader.py Read cookies.binarycookies Files
Lsof ARM Binary Https://github.com/u35tpus/iosrep/tree/master/lsof List of all open files and the processes that opened them
Lsock ARM Binary Http://www.newosxbook.com/index.php?page=downloads Monitor socket connections
Ponydebugger injected https://github.com/dtrukr/PonyDebuggerInjected Injected via CYCRIPT to enable remote debugging
Weak Class Dump Https://raw.github.com/limneos/weak_classdump/master/weak_classdump.cy Injected via Cycript to do class-dump (if you cant un-encrypt the binary)
TrustMe Https://github.com/intrepidusgroup/trustme Lower level tool to disable SSL Certificate validation-including certificate pinning (for everything else but Nsurl)
MAC robber http://www.sleuthkit.org/mac-robber/download.php C Code, Forensic tool for imaging filesystems and producing a timeline
Usbmux Proxy Https://github.com/st3fan/usbmux-proxy Command line tool to connect local TCP port sto ports on a iPhone or iPod Touch device over USB.
IFunBox http://www.i-funbox.com/ Filesystem access (no jailbreak needed), Usbmux tunneler,. IPA installer
Inalyzer https://appsec-labs.com/iNalyzer/ IOS Penetration Testing Framework
Removepie Https://github.com/peterfillmore/removePIE Disables ASLR of an application
Snoop-it https://code.google.com/p/snoop-it/ A tool to assist security assessments and dynamic analysis of IOS Apps, includes runtime views of obj-c classes and method s, and options to modify those values
Idb Https://github.com/dmayer/idb A GUI (and cmdline) tool to simplify some common tasks for IOS pentesting and.
Damn Vulnerable IOS Application http://damnvulnerableiosapp.com/ A purposefully vulnerable iOS application for Learning iOS application assessment skills.
Introspy Https://github.com/iSECPartners/Introspy-iOS A Security Profiling tool revolved around hooking security based IOS APIs and logging their output for security analysis
Reprinted from: Https://www.owasp.org/index.php/IOS_Application_Security_Testing_Cheat_Sheet

IOS Application Security Testing Cheat Sheet

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.