What it does. Runtime iOS app security testing with Objection (Frida): inspect keychain and filesystem data, explore app internals at runtime, and validate/bypass client-side protections during authorized mobile assessments. Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-ios-app-security-with-objection, or copy the skill folder into ~/.claude/skills/analyzing-ios-app-security-with-objection/.- Raw file:
curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-ios-app-security-with-objection/SKILL.md
SKILL.md (verbatim)
name: analyzing-ios-app-security-with-objection
description: >-
Runtime iOS app security testing with Objection (Frida): inspect keychain and
filesystem data, explore app internals at runtime, and validate/bypass
client-side protections during authorized mobile assessments.
domain: cybersecurity
subdomain: mobile-security
author: mahipal
tags:
- mobile-security
- ios
- objection
- frida
- owasp-mobile
- penetration-testing
version: 1.0.0
license: Apache-2.0
atlas_techniques:
- AML.T0054
nist_ai_rmf:
- MEASURE-2.7
- MANAGE-2.4
- GOVERN-6.2
- MAP-5.1
nist_csf:
- PR.PS-01
- PR.AA-05
- ID.RA-01
- DE.CM-09
mitre_attack:
- T1635
- T1414
- T1417.001
- T1409
Analyzing iOS App Security with Objection
When to Use
Use this skill when:
- Performing runtime security assessment of iOS applications during authorized penetration tests
- Inspecting iOS keychain, filesystem, and memory for sensitive data exposure
- Bypassing client-side security controls (SSL pinning, jailbreak detection) during security testing
- Evaluating iOS app behavior at runtime without access to source code
Do not use this skill on production devices without explicit authorization -- Objection modifies app runtime behavior and may trigger security monitoring.
Prerequisites
- Python 3.10+ with pip
- Objection installed:
pip install objection
- Frida installed:
pip install frida-tools
- Target iOS device (jailbroken with Frida server, or non-jailbroken with repackaged IPA)
- For non-jailbroken:
objection patchipa to inject Frida gadget into IPA
- macOS recommended for iOS testing (Xcode, ideviceinstaller)
- USB connection to target device or network Frida server
Workflow
Step 1: Prepare the Testing Environment
For jailbroken devices:
# Install Frida server on device via Cydia/Sileo
# SSH to device and start Frida server
ssh root@<device_ip> "/usr/sbin/frida-server -D"
# Verify Frida connectivity
frida-ps -U # List processes on USB-connected device
For non-jailbroken devices (authorized testing):
# Patch IPA with Frida gadget
objection patchipa --source target.ipa --codesign-signature "Apple Development: test@example.com"
# Install patched IPA
ideviceinstaller -i target-patched.ipa
Step 2: Attach Objection to Target App
# Attach to running app by bundle ID
objection --gadget "com.target.app" explore
# Or spawn the app fresh
objection --gadget "com.target.app" explore --startup-command "ios hooking list classes"
Once attached, Objection provides an interactive REPL for runtime exploration.
Step 3: Assess Data Storage Security (MASVS-STORAGE)
# Dump iOS Keychain items accessible to the app
ios keychain dump
# List files in app sandbox
ios plist cat Info.plist
env # Show app environment paths
# Inspect NSUserDefaults for sensitive data
ios nsuserdefaults get
# List SQLite databases
sqlite connect app_data.db
sqlite execute query "SELECT * FROM credentials"
# Check for sensitive data in pasteboard
ios pasteboard monitor
Step 4: Evaluate Network Security (MASVS-NETWORK)
# Disable SSL/TLS certificate pinning
ios sslpinning disable
# Verify pinning is bypassed by observing traffic in Burp Suite proxy
# Monitor network-related class method calls
ios hooking watch class NSURLSession
ios hooking watch class NSURLConnection
Step 5: Inspect Authentication and Authorization (MASVS-AUTH)
# List all Objective-C classes
ios hooking list classes
# Search for authentication-related classes
ios hooking search classes Auth
ios hooking search classes Login
ios hooking search classes Token
# Hook authentication methods to observe parameters
ios hooking watch method "+[AuthManager validateToken:]" --dump-args --dump-return
# Monitor biometric authentication calls
ios hooking watch class LAContext
Step 6: Assess Binary Protections (MASVS-RESILIENCE)
# Check jailbreak detection implementation
ios jailbreak disable
# Simulate jailbreak detection bypass
ios jailbreak simulate
# List loaded frameworks and libraries
memory list modules
# Search memory for sensitive strings
memory search "password" --string
memory search "api_key" --string
memory search "Bearer" --string
# Dump specific memory regions
memory dump all dump_output/
# List URL schemes registered by the app
ios info binary
ios bundles list_frameworks
# Hook URL scheme handlers
ios hooking watch method "-[AppDelegate application:openURL:options:]" --dump-args
# Monitor clipboard access
ios pasteboard monitor
# Check for custom keyboard restrictions
ios hooking search classes UITextField
Key Concepts
| Term |
Definition |
| Objection |
Runtime mobile exploration toolkit built on Frida that provides pre-built scripts for common security testing tasks |
| Frida Gadget |
Shared library injected into app process to enable Frida instrumentation without jailbreak |
| Keychain |
iOS secure credential storage system; Objection can dump items accessible to the target app's keychain access group |
| SSL Pinning Bypass |
Runtime modification of certificate validation logic to allow proxy interception of HTTPS traffic |
| Method Hooking |
Intercepting Objective-C/Swift method calls at runtime to observe arguments, return values, and modify behavior |
- Objection: High-level Frida-powered mobile security exploration toolkit with pre-built commands
- Frida: Dynamic instrumentation framework providing JavaScript injection into native app processes
- Frida-tools: CLI utilities for Frida including frida-ps, frida-trace, and frida-discover
- ideviceinstaller: Cross-platform tool for installing/managing iOS apps via USB
- Burp Suite: HTTP proxy for intercepting traffic after SSL pinning bypass
Common Pitfalls
- App crashes on attach: Some apps implement Frida detection. Use
--startup-command to hook anti-Frida checks early in the app lifecycle.
- Keychain access scope: Objection can only dump keychain items within the app's access group. System keychain items require separate jailbreak-level tools.
- Swift name mangling: Swift method names are mangled in the runtime. Use
ios hooking list classes with grep to find demangled names.
- Non-persistent changes: All Objection modifications are runtime-only and reset on app restart. Document findings immediately.
Other files in this skill
assets/template.md (verbatim)
iOS Objection Security Assessment Report
| Field |
Value |
| Application |
[APP_NAME] |
| Bundle ID |
[BUNDLE_ID] |
| iOS Version |
[IOS_VERSION] |
| Device |
[DEVICE_MODEL] |
| Device State |
[Jailbroken/Non-Jailbroken] |
| Assessment Date |
[DATE] |
| Analyst |
[ANALYST] |
| Objection Version |
[VERSION] |
Executive Summary
[Brief narrative of findings from Objection runtime analysis]
Keychain Analysis
| Service |
Account |
Data Type |
Protection Class |
Risk |
| [SERVICE] |
[ACCOUNT] |
[TYPE] |
[CLASS] |
[RISK] |
Findings: [Description of sensitive data found in keychain]
Data Storage Assessment
NSUserDefaults
| Key |
Contains Sensitive Data |
Risk |
| [KEY] |
[YES/NO] |
[RISK] |
SQLite Databases
| Database |
Encrypted |
Sensitive Tables |
Risk |
| [DB_NAME] |
[YES/NO] |
[TABLES] |
[RISK] |
Filesystem
| Path |
Contents |
Protection |
Risk |
| [PATH] |
[DESCRIPTION] |
[ATTRIBUTE] |
[RISK] |
Network Security
| Check |
Result |
Details |
| SSL Pinning Present |
[YES/NO] |
[IMPLEMENTATION_DETAILS] |
| SSL Pinning Bypass |
[SUCCESS/FAIL] |
[METHOD_USED] |
| ATS Configuration |
[STRICT/RELAXED] |
[EXCEPTIONS] |
Binary Protection Assessment
| Protection |
Status |
Details |
| Jailbreak Detection |
[Present/Absent] |
[BYPASS_DIFFICULTY] |
| Frida Detection |
[Present/Absent] |
[DETAILS] |
| Debug Detection |
[Present/Absent] |
[DETAILS] |
| Code Obfuscation |
[Yes/No] |
[DETAILS] |
Memory Analysis
| Search Pattern |
Found |
Risk |
Details |
| Passwords |
[YES/NO] |
[RISK] |
[DETAILS] |
| Auth Tokens |
[YES/NO] |
[RISK] |
[DETAILS] |
| API Keys |
[YES/NO] |
[RISK] |
[DETAILS] |
| JWTs |
[YES/NO] |
[RISK] |
[DETAILS] |
Recommendations
Critical
- [RECOMMENDATION]
High
- [RECOMMENDATION]
Medium
- [RECOMMENDATION]
references/api-reference.md (verbatim)
API Reference: iOS App Security with Objection
Objection CLI
Launch
objection -g com.example.app explore # Attach to running app
objection -g com.example.app explore -s "command" # Run startup command
objection patchipa --source app.ipa # Patch IPA with Frida gadget
Keychain & Data Storage
ios keychain dump # Dump keychain items
ios keychain dump --json # JSON output
ios cookies get # List HTTP cookies
ios nsuserdefaults get # Read NSUserDefaults
ios plist cat Info.plist # Read plist file
SSL Pinning
ios sslpinning disable # Bypass SSL pinning
ios sslpinning disable --quiet # Quiet mode
Jailbreak Detection
ios jailbreak disable # Bypass jailbreak detection
ios jailbreak simulate # Simulate jailbroken device
Hooking
ios hooking list classes # List all classes
ios hooking list classes --include Auth # Filter classes
ios hooking list class_methods ClassName # List methods
ios hooking watch method "-[Class method]" # Watch method calls
ios hooking set return_value "-[Class isJB]" false # Override return
Filesystem
ls / # List app sandbox root
ls /Documents # List Documents directory
file download /path/to/file local.out # Download file
file upload local.file /remote/path # Upload file
Memory
memory dump all dump.bin # Dump all memory
memory search "password" # Search memory for string
memory list modules # List loaded modules
memory list exports libModule.dylib # List module exports
Frida CLI
Syntax
frida -U -n AppName # Attach by name
frida -U -f com.app.id # Spawn and attach
frida -U -n AppName -l script.js # Load script
frida-ps -U # List running processes
frida-ls-devices # List connected devices
Common Frida Scripts
// Hook method and log arguments
ObjC.choose(ObjC.classes.ClassName, {
onMatch: function(instance) {
Interceptor.attach(instance['- methodName:'].implementation, {
onEnter: function(args) {
console.log('arg1:', ObjC.Object(args[2]));
}
});
}, onComplete: function() {}
});
OWASP Mobile Top 10 (2024)
| ID |
Category |
Objection Check |
| M1 |
Improper Credential Usage |
ios keychain dump |
| M2 |
Inadequate Supply Chain Security |
Binary analysis |
| M3 |
Insecure Authentication |
Hook auth classes |
| M4 |
Insufficient Input/Output Validation |
Hook input methods |
| M5 |
Insecure Communication |
ios sslpinning disable |
| M6 |
Inadequate Privacy Controls |
ios nsuserdefaults get |
| M7 |
Insufficient Binary Protections |
Check PIE, ARC, stack canary |
| M8 |
Security Misconfiguration |
ios plist cat Info.plist |
| M9 |
Insecure Data Storage |
Filesystem + keychain review |
| M10 |
Insufficient Cryptography |
Hook crypto classes |
iOS App Sandbox Paths
| Path |
Contents |
/Documents |
User-generated data |
/Library/Caches |
Cached data |
/Library/Preferences |
Plist settings |
/tmp |
Temporary files |
/Library/Cookies |
Cookie storage |
references/standards.md (verbatim)
Standards Reference: iOS App Security with Objection
OWASP Mobile Top 10 2024 Mapping
| OWASP ID |
Risk |
Objection Testing Coverage |
| M1 |
Improper Credential Usage |
Keychain dumping, memory string search for hardcoded credentials |
| M3 |
Insecure Authentication/Authorization |
Hook authentication methods, bypass biometric checks |
| M5 |
Insecure Communication |
SSL pinning bypass, network class hooking |
| M7 |
Insufficient Binary Protections |
Jailbreak detection bypass, Frida detection assessment |
| M8 |
Security Misconfiguration |
Info.plist review, URL scheme analysis, ATS configuration |
| M9 |
Insecure Data Storage |
NSUserDefaults inspection, SQLite database access, file system review |
OWASP MASVS v2.0 Control Mapping
| MASVS Category |
Objection Commands |
Assessment Area |
| MASVS-STORAGE |
ios keychain dump, ios nsuserdefaults get, sqlite connect |
Sensitive data in keychain, NSUserDefaults, databases |
| MASVS-CRYPTO |
memory search, hook crypto framework calls |
Key storage, algorithm selection |
| MASVS-AUTH |
Hook LAContext, authentication classes |
Biometric bypass, session management |
| MASVS-NETWORK |
ios sslpinning disable, hook NSURLSession |
Certificate pinning, cleartext traffic |
| MASVS-PLATFORM |
Hook URL scheme handlers, pasteboard monitor |
Deep link security, clipboard exposure |
| MASVS-CODE |
memory list modules, binary inspection |
Debugging symbols, framework analysis |
| MASVS-RESILIENCE |
ios jailbreak disable, Frida detection hooks |
Anti-tampering, anti-debugging |
OWASP MASTG Test Cases
| Test ID |
Description |
Objection Approach |
| MASTG-TEST-0053 |
Testing Local Storage for Sensitive Data |
ios keychain dump, filesystem inspection |
| MASTG-TEST-0057 |
Testing Backups for Sensitive Data |
Check backup exclusion attributes |
| MASTG-TEST-0060 |
Testing Custom URL Schemes |
Hook application:openURL:options: |
| MASTG-TEST-0063 |
Testing for Sensitive Data in Logs |
Monitor NSLog calls via hooking |
| MASTG-TEST-0066 |
Testing Enforced App Transport Security |
Inspect Info.plist ATS configuration |
| Requirement |
Assessment Method |
| Keychain Access Control |
Verify kSecAttrAccessible values via keychain dump |
| App Transport Security |
Check Info.plist for NSAllowsArbitraryLoads exceptions |
| Data Protection API |
Verify file protection attributes on sensitive files |
| Secure Enclave Usage |
Hook SecKey operations for biometric-protected keys |
references/workflows.md (verbatim)
Workflows: iOS App Security with Objection
Workflow 1: iOS Runtime Security Assessment
[Setup Environment] --> [Prepare Device] --> [Attach Objection] --> [Runtime Analysis]
| | | |
v v v v
[Install Frida] [Jailbroken: Start [Connect via USB] [Data Storage Check]
[Install Objection] frida-server] [Spawn target app] [Network Security]
[Non-JB: Patch IPA] [Auth Mechanism Review]
[Binary Protection Test]
|
v
[Document Findings]
[Generate Report]
Workflow 2: SSL Pinning Bypass for Traffic Interception
[Configure Burp Proxy] --> [Set device proxy] --> [Attach Objection]
|
v
[ios sslpinning disable]
|
v
[Navigate app in browser/UI]
|
v
[Capture HTTPS traffic in Burp]
[Analyze API endpoints]
[Test authentication flows]
[Check for sensitive data in transit]
Workflow 3: Keychain and Data Storage Assessment
[Attach Objection] --> [ios keychain dump] --> [Analyze keychain items]
| |
v v
[ios nsuserdefaults get] [Check protection classes]
| [Identify sensitive tokens]
v [Verify encryption at rest]
[List app sandbox files]
|
v
[sqlite connect *.db]
[Query sensitive tables]
|
v
[memory search "password"]
[memory search "token"]
[memory search "secret"]
Workflow 4: Jailbreak Detection Assessment
[Attach Objection] --> [ios jailbreak disable] --> [Navigate app]
| |
v [App functions normally?]
[Hook detection methods] / \
[Monitor file checks] [Yes] [No]
[Monitor Cydia URL scheme] | |
| [Detection [Additional detection
v bypassed] methods exist]
[Document detection |
methods found] [Hook deeper: search
[Assess bypass for custom checks]
difficulty] [Frida script for
targeted bypass]
Decision Matrix: Testing Approach
| Device State |
IPA Access |
Approach |
| Jailbroken |
Not needed |
Direct Frida server + Objection attach |
| Non-jailbroken |
Available |
Patch IPA with objection patchipa |
| Non-jailbroken |
Not available |
Request IPA from client or use device management |
| Emulator |
N/A |
Limited: Frida on Corellium or similar platform |
Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.