Shqyrtimi i Sigurisë së një Aplikacioni iOS

An IPA is a ZIP archive containing the compiled Mach-O binary, resources and Info.plist of an iOS application.

IPAs downloaded from the App Store are encrypted with FairPlay DRM, which makes static analysis harder. Tools like frida-ios-dump and Bagbak running on a jailbroken device can dump the decrypted binary, after which class-dump, Hopper and Ghidra can analyze it. Info.plist is the analog of AndroidManifest.xml: it declares URL schemes, background modes, supported device capabilities, App Transport Security overrides, and the privacy permission strings that will be shown to users. Things to look for: hardcoded URLs and API endpoints, tokens or keys in strings, weak network configuration (NSAllowsArbitraryLoads bypassing ATS), use of deprecated crypto APIs, unprotected keychain items, and custom URL scheme handlers that could be invoked by other apps. The MASVS (Mobile Application Security Verification Standard) from OWASP provides a structured checklist for each of these areas. Dynamic analysis on iOS also relies on Frida and Objection, which can hook Objective-C and Swift methods at runtime, bypass jailbreak detection, intercept keychain calls, and dump decrypted memory. Combined with Burp or mitmproxy for traffic inspection, they cover most iOS app testing scenarios. The learning curve is steeper than Android but the tools and techniques are comparable.

Mjete:

• MobSF, class-dump, Hopper.
• Frida + objection (mbi device jailbroken ose simulator).
• Burp me CA të instaluar + SSL pinning bypass.

Extract IPA dhe inspektim:

unzip app.ipa -d app
class-dump -H app/Payload/App.app/App -o headers/
plutil -p app/Payload/App.app/Info.plist
frida -U -f com.example.app -l bypass-pinning.js

1. Bëj static review të një IPA me MobSF.
2. Gjej një ATS exception ose hardkoduar API key.

• OWASP MSTG (legacy) / MAS.
• Frida codeshare — codeshare.frida.re.