iOS App Penetration Testing
Manual security testing of iOS applications — Keychain and Data Protection usage, ATS configuration, jailbreak-detection resilience, and runtime instrumentation.
Selva Ops S.R.L.
iOS applications fail in platform-specific ways, and generic “mobile testing” misses them. This assessment targets the controls Apple gives developers — and the ways real apps misuse them.
iOS-specific coverage
- Keychain and Data Protection — are secrets in the Keychain with appropriate accessibility classes, or in
UserDefaultsand plist files? Do files useNSFileProtectionCompletewhere the data warrants it? - App Transport Security (ATS) — exceptions declared in
Info.plist, their justification, and whether TLS validation or certificate pinning can be bypassed with standard instrumentation. - Jailbreak detection and anti-tampering — whether the checks exist, whether they can be trivially hooked out with Frida or Objection, and whether anything sensitive actually depends on them.
- Runtime manipulation — method swizzling and hooking of security-relevant logic (biometric gates, paywalls, PIN screens) to test whether client-side enforcement is backed by the server.
- Data leakage channels — pasteboard, snapshot caching, keyboard cache,
NSLog/os_log output, files shared via iTunes/Files app entitlements. - Deep links and extensions — URL scheme and Universal Link handling, input validation in share/app extensions.
The backend is in scope
An iOS client is one half of the system. The endpoints it calls are tested with the same depth as an API penetration test — that is where most high-severity findings live. Shared methodology, scoping, and deliverables are described on the mobile testing hub.
What you receive
- A report with reproduction steps, evidence, and severity ratings for every finding
- Findings mapped to OWASP MASVS controls
- Remediation guidance specific to iOS APIs (Keychain, Data Protection, ATS)
- Retest of fixed findings and an updated report
Standards and references
Compliance context
FAQ
- Do you test on jailbroken devices?
- Yes. Instrumented testing on jailbroken hardware (or equivalent tooling such as Frida on non-jailbroken devices) is how storage, runtime, and pinning controls are actually evaluated. If your threat model excludes jailbroken devices, that assumption is tested rather than accepted.