Pentesting iOS Apps

Set up Aikido Pentest to test a native or hybrid iOS app.

Aikido Pentest assesses native and hybrid iOS apps on a Mobile Application assessment. Testing is whitebox, so connect the repository that contains the iOS app source code.

Test one app or both

On the Scope step, upload the mobile apps this assessment should cover and add the web app or API they call.

Add the web URL when the app has a backend. Upload both apps when you have Android and iOS, so one assessment tests that shared web app or API once and covers both clients. Separate assessments repeat that work.

A website or API with no mobile app is a Web Application assessment. See How to Setup a Pentest.

Prerequisites

• Manage Pentests permission
• Sufficient credits in your wallet
• Your iOS app source code in a repository you can connect to Aikido
• A signed, unencrypted IPA (500 MB max) with no certificate pinning, jailbreak detection, or emulator checks

Prepare the IPA

Aikido installs the IPA you upload. App Store and TestFlight builds are FairPlay-encrypted, so Aikido can't install them. Export a Development, Ad Hoc, or Enterprise IPA from Xcode. That file is signed and not encrypted.

In that test build:

• Turn off certificate pinning.
• Turn off jailbreak detection and emulator checks.

1. In Xcode, choose Product → Archive.
2. In the Organizer, click Distribute App.
3. Select Development, Ad Hoc, or Enterprise.
4. Export the .ipa.

Hybrid apps (for example React Native or Flutter) use the same export. The file must be an .ipa, not an .app or an .xcarchive.

Create an iOS assessment

1. 1

   Select Mobile Application

   Go to Pentests, open your Project, and click Create Assessment. On the Select Pentest Target step, select Mobile Application.

2. 2

   Define test scope

   On the Scope step, add the web app or API URL (for example, https://api.application.com) so Aikido can test those endpoints.

   Under iOS Application, upload the IPA (500 MB max). Aikido reads the bundle ID from the file. The IPA must be unencrypted, and it must not use certificate pinning, jailbreak detection, or emulator checks.

   Upload the IPA on its own for an iOS-only run. Upload the APK on this step as well when the assessment should cover both apps. See Pentesting Android Apps.

   Choose Test entire application or Test specific parts only.

3. 3

   Add test users

   Add a test user for each role you want Aikido to test, such as an admin, a standard user, or a user from another tenant.

   If the assessment includes both apps, set Platform to iOS for the iOS user. For username and password authentication, Aikido uses the bundle ID instead of a login URL.

   You can run the login preflight check before you launch. See Setting Up Test Users.

4. 4

   Configure access, context, and safety

   Configure the remaining steps in the wizard:

   • Allowed Domains: Allow domains that the app needs to reach during testing.
   • Code & Documentation: Connect the repository that contains the iOS app source code. Aikido only supports whitebox testing for mobile apps, so the assessment needs that repository. You can also link backend repositories and add documentation. See Leveraging Code and Documentation.
   • Safety Check: Set the request rate and permitted testing hours. See Safety Measures.
   • Pricing: Select the assessment profile and review the credit cost. See Pentest Pricing.
5. 5

   Review and launch

   On the Summary step, confirm the iOS App bundle ID and the rest of the configuration, then click Run Assessment.

Review results

Open the assessment to follow progress and review its Issues tab. iOS findings can cover sensitive data handling, network security, URL schemes and universal links, WebView security, client-side authentication, cryptography, privacy, and release configuration.

When the assessment is complete, download a PDF from the assessment. See Pentest Reports.

Replacing the IPA on an existing assessment is coming soon. See Retest Pentest Findings.

Related