Testing iOS Apps without Jailbreak in 2018
Talkat OWASP AppSec Europe 2018 · on Thursday, 2018-07-05· at 14:15· Fleming - 3rd Floor, QEII Centre Broad Sanctuary, Westminster·
summary
Claims a jailbreak-free workflow that actually injects a dynamic library into an app, demonstrates Frida gadget + PassionFruit for live inspection, and uses tools like objection to dump the keychain and app caches; shows bypassable weaknesses with concrete numbers (83% ATS misconfigurations, ~10% ZipperDown impact) and gives a repeatable writeup plus the signing/provisioning steps needed because Apple FairPlay blocks direct App Store IPA extraction; notes instability (PassionFruit/keychain crashes) and extra work to disable certificate pinning without a jailbreak.
AI-written summary · about
chapters (9)
- 0:00Introduction and context
- 2:26Market and security relevance
- 4:31Common iOS vulnerabilities
- 7:44Analysis and testing standards
- 10:51The role of jailbreaking
- 13:30Jailbreak limitations
- 20:11Alternative testing method
- 25:06Practical demo and tools
- 32:30Challenges and conclusion
related talks
58mUncovering OWASP’s Mobile Risks in iOS Apps
29miOS Runtime Manipulation (PWND)
47mBASHing iOS Applications
09mBypassing Jailbreak Detection
40mIntroduction into Reverse Engineering and iOS Security
36mState Of IOS Jailbreaking In 2025
49mHow to Hack Your Own Mobile App
01h 14mHacking and Injecting Your Own Code into Someone Else's App