/ios-redteam-pipeline

name: ios-redteam-pipeline
description: End-to-end iOS red-team pipeline — IPA acquisition (App Store extraction, TestFlight, enterprise/ad-hoc sideload), class-dump/Hopper/Ghidra static analysis, Info.plist + entitlements + Keychain secret extraction, App Transport Security (ATS) misconfig + certificate-pinning bypass (frida-ios-dump, objection, SSL Kill Switch 2), URL-scheme / Universal Link hijack, exported-service enumeration, Frida runtime instrumentation. Companion to apk-redteam-pipeline for the iOS side of a mobile app catalogue. Use when target has an iOS app (App Store listing, TestFlight link, enterprise MDM distribution), when an IPA URL is found hosted on a web server, or when post-recon mentions "iOS app" / "mobile app" in scope alongside an Apple developer account.
sources: public_research, frida_docs, objection_docs, owasp_mastg
report_count: 0

When to use this skill

Trigger when:

• Recon surfaces 1+ apps under the target's Apple Developer / App Store publisher page
• A TestFlight public link or enterprise/ad-hoc `.ipa`/`manifest.plist` (OTA install) is found
• Customer-facing app, dealer/partner portal, or employee mobile companion app ships on iOS
• Bug bounty program lists iOS in scope
• `apk-redteam-pipeline` already found Android endpoints/secrets — the iOS build often ships a *different* backend version worth diffing (see `hunt-shadow-api`)

DO NOT use for:

• Android-only targets — that's `apk-redteam-pipeline`
• React Native / Flutter apps already fully covered by JS-bundle analysis on the web side
• Server-side only assessments with no mobile client in scope

---

Stage 0 — Inventory all org-owned iOS apps

# App Store search API (no auth, no scraping needed)
curl -s "https://itunes.apple.com/search?term=<brand>&country=us&entity=software&limit=50" | python3 -m json.tool

# Pull the full metadata for a known bundle ID (once you have one)
curl -s "https://itunes.apple.com/lookup?bundleId=com.<brand>.app&country=us"

Extract: `trackId`, `bundleId`, `sellerName` (developer account — pivot to find sibling apps), `version`, `releaseNotes` (changelogs often reference deprecated/removed API behavior — feeds `hunt-shadow-api`).

Cross-reference sibling-app bundle IDs surfaced from Android APK inventories (same multi-brand conglomerate usually reuses `com.<corp>.<sub-brand>` naming on both platforms).

---

Stage 1 — IPA acquisition

Primary: from a real device you control (no jailbreak needed for a purchased/free app)

# Install the app on a real device via Apple Configurator 2 or Xcode, then pull the .ipa
# Apple Configurator 2 (macOS): Devices > select device > right-click installed app > "Save to..."
# Or via libimobiledevice:
brew install libimobiledevice ideviceinstaller
ideviceinstaller -l              # list installed apps + bundle IDs

Secondary: TestFlight (if the program distributes betas publicly)

Open the public TestFlight link, install via the TestFlight app, then extract as above. TestFlight builds are frequently LESS hardened than App Store releases (debug logging left on, staging API hosts hardcoded) — always prefer a TestFlight build over the Store build if both exist.

Tertiary: enterprise / ad-hoc distribution (OTA install)

# itms-services:// links embed a manifest.plist with a direct .ipa URL
curl -s "https://<target>/manifest.plist" | plutil -convert xml1 -o - -
# Look for <key>software-package</key> — that URL is a directly downloadable, unencrypted IPA
curl -sk -L "<software-package-url>" -o target.ipa

Enterprise/ad-hoc IPAs are **not FairPlay-encrypted** — no jailbreak or decryption tooling needed, unlike an App Store binary pulled from a device.

Decrypting an App-Store-sourced binary (only if extracted from a jailbroken device)

App Store binaries are FairPlay-encrypted at rest; a binary copied off a jailbroken device needs runtime decryption (`frida-ios-dump`, `bagbak`, or `flexdecrypt`) before static tools can read it meaningfully:

pip install --break-system-packages frida-tools
# with frida-server running on the jailbroken device and the app in foreground:
python3 dump.py <bundle_id>          # frida-ios-dump — outputs a decrypted .ipa

---

Stage 2 — Unpack and static analysis

# An IPA is just a zip
unzip -o target.ipa -d extracted_target/
cd extracted_target/Payload/*.app

# Info.plist — bundle ID, URL schemes, ATS config, entitlements hint
plutil -convert xml1 -o - Info.plist

# Entitlements — codesign reads the .app bundle (or the Mach-O binary), NOT Info.plist
codesign -d --entitlements :- Payload/<AppName>.app 2>/dev/null || \
  security cms -D -i embedded.mobileprovision | plutil -convert xml1 -o - -

# class-dump for Objective-C symbol/class recovery (compiled binary, not the .app bundle)
brew install class-dump
class-dump -H <AppBinaryName> -o headers/

# Swift binaries: class-dump won't show much — use Hopper, Ghidra, or `nm`/`strings` instead
nm -a <AppBinaryName> | grep -i swift | head -50
strings -a <AppBinaryName> > strings_target.txt

For a fast triage pass without a disassembler, the strings dump alone usually surfaces most of what Stage 3 is looking for.

---

Stage 3 — Secret grep (same catalog as apk-redteam-pipeline, iOS-specific sources added)

# URL grep — owned-domain references
grep -oE 'https?://[a-zA-Z0-9.-]+\.(target1|target2|target3)\.(com|io|net)[a-zA-Z0-9./_?=&%-]*' strings_target.txt | sort -u

# Cloud credentials (same 60-pattern catalog as Android — reuse verbatim)
grep -oE 'AKIA[A-Z0-9]{16}'                             # AWS Access Key
grep -oE 'AIza[A-Za-z0-9_-]{35}'                        # Google API key
grep -oE 'eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*' strings_target.txt   # JWT

# iOS-specific: GoogleService-Info.plist (Firebase config bundled per-platform)
find extracted_target -iname "GoogleService-Info.plist" -exec plutil -convert xml1 -o - {} \;
# Look for API_KEY, PROJECT_ID, STOR