iOS Application Security
Test your own iOS apps the OWASP MASTG way: Keychain and storage, TLS pinning, jailbreak detection, URL schemes and the mobile API. Authorized testing only.
One-time payment · lifetime access · lessons, labs, exam and certificate included · no subscription.
About this course
This course walks through assessing the security of an iOS app you own, following the OWASP MASTG methodology. You learn why App Store binaries are FairPlay-encrypted and how to obtain a decrypted copy, then analyse the Mach-O binary with tools such as otool and class-dump. Dynamic lessons use Frida and objection to hook methods, inspect the Keychain, and spot insecure storage in NSUserDefaults or plists. You intercept API traffic through a proxy by disabling TLS pinning on a test build, study jailbreak and anti-Frida detection, and review URL schemes, universal links and snapshot data leakage. A final section covers backend bugs like BOLA and IDOR. Everything is practised on your own app, the iOS Simulator, or public learning apps, for authorized testing only. Quizzes and a final exam lead to the Tabellab certificate.
Lessons
- iOS App Security — Getting Started Pro
- Tooling & Getting the App Binary Pro
- Keychain & Insecure Storage Pro
- Runtime Hooking & Jailbreak Detection Pro
- Traffic Interception & TLS Pinning Pro
- Static Analysis & the Mach-O Binary Pro
- Anti-Frida & Anti-Hook Checks Pro
- URL Schemes, Universal Links & IPC Pro
- Side-Channel Data Leakage Pro
- The Mobile Backend — IDOR, BOLA & Tokens Pro
- Final Exam — Assess an iOS App Pro