What problem does it solve? Security testers assessing iOS applications need a repeatable workflow to acquire app binaries, recover secrets, and identify network and runtime weaknesses, but the tooling and steps are fragmented across many utilities and platforms. ## Core Features & Use Cases - IPA Acquisition & Unpacking: Pull apps from the App Store, TestFlight, or enterprise/ad-hoc OTA manifests, decrypt FairPlay-protected binaries with frida-ios-dump, and unpack the IPA for static analysis with class-dump, nm, and strings. - Secret & Configuration Extraction: Grep binaries and bundled plists for hardcoded API keys, JWTs, Firebase configs (GoogleService-Info.plist), ATS exceptions, URL schemes, and entitlements. - Runtime Instrumentation: Bypass certificate pinning with objection or SSL Kill Switch 2, hook classes with Frida, dump Keychain items, and capture traffic through mitmproxy on a jailbroken device or Corellium. - Use Case: During a bug bounty engagement, recon surfaces a public TestFlight link for the target's iOS app. Use this Skill to extract the unencrypted build, recover a hardcoded staging API key, and hand the older API version off to shadow-API diffing. ## Quick Start Run the iOS red-team pipeline against the target's App Store app starting with inventory and IPA acquisition, then report any hardcoded secrets and ATS misconfigurations found.
