iGoat: A Self Learning Tool for iOS App Pentesting and Security
summary
An open‑source iOS training app teaches specific exploits and fixes: a client‑server iGoat with lessons that demonstrate plaintext local storage, hard‑coded keys discovered with Hopper disassembler, runtime PIN extraction via cycript, server‑side key retrieval leaking keys over intercepted requests, per‑device keys from UIDevice APIs, S3 bucket misconfiguration exposing files, and SQLi/XSS in a search box. Exercises run on iPhone/iPad simulators and devices, include commented fixes to rebuild, and the repo accepts contributions and updated challenge packs.
AI-written summary · about
chapters (23)
- 0:00Intro
- 0:30About me
- 1:10Agenda
- 2:00Why Care
- 2:30Your Smartphone
- 4:20WhatsApp
- 5:05Phone ID
- 5:28Challenges
- 6:34Smartphone Robbery
- 6:51Jailbreak
- 7:07PIN bruteforce
- 7:52About iGoat
- 9:01Challenges for enterprises
- 9:24Approach
- 9:39How it works
- 11:33Best thing about iGoat
- 11:55How to contribute
- 12:05Demo Runtime Analysis
- 14:59Demo
- 16:53ServerSide Key Storage
- 19:23URL Scheme
- 20:33Cloud Miss Configuration
- 23:25Conclusion
related talks
15mPentesting Swift Application with OWASP iGoat
58mUncovering OWASP’s Mobile Risks in iOS Apps
49mHow to Hack Your Own Mobile App
47mBASHing iOS Applications
27miOS Attack Vectors and how to protect your app
23mIntroduction to security research and bounty hunting on Apple's platforms
33mBuilding Secure iOS Apps (you don’t have to learn it the hard way!)
47mSecurity Threats & Mitigations for iOS Developers