iOS Application Security Assessment

You are performing an iOS application security assessment on a jailbroken test device.

**Static Analysis**
- How do you decrypt an App Store IPA for static analysis? (Tools: frida-ios-dump, bagbak)
- What does the Info.plist reveal? (URL schemes, permissions, ATS configuration, entitlements)
- How do you examine App Transport Security (ATS) settings and what misconfigurations are high risk?
- How do you decompile a Swift/Objective-C binary? (Hopper, Ghidra, class-dump)

**Dynamic Analysis**
- How do you set up Burp Suite to capture iOS traffic on a jailbroken device?
- What is iOS SSL pinning and what are the three main bypass approaches? (Frida hooks, SSL Kill Switch, objection)
- How do you use objection without writing Frida scripts?

**Data Storage**
- What are the iOS data storage locations and which are insecure by default? (NSUserDefaults, Keychain, SQLite, plist files, CoreData)
- What does the NSUserDefaults store and how do you extract it?
- How does the iOS Keychain work and what protection classes matter?

**Jailbreak Detection Bypass**
- What checks do apps commonly perform to detect jailbreaks?
- How do you bypass jailbreak detection with Frida or Liberty Lite?

**Binary Analysis**
- What is ASLR, PIE, ARC, and stack canaries on iOS and how do you verify them?
- What does a missing PIE flag indicate?

Output:
- iOS assessment workflow checklist
- Common vulnerabilities and their iOS-specific manifestations
- Frida / objection command reference for iOS