Apple's mobile version of OS X operating system, which is used on Apple computers, is iOS. The iOS operating system is used on a wide range of Apple devices, including iPhone, iPad, iPod, and so on. It is derived from OS X and Unix-based operating system. In the next chapter, when we will access the iOS operating system that is running on
iDevice, you will find that iOS almost has the same environment as Unix-based OS, for example, the /etc directory, /home directory, and so on.
The iOS apps are mainly developed in Objective-C. Recently, Apple introduced one more language called Swift. There are still millions of apps in App Store that are developed in Objective-C. For the scope of this book, we will focus on native apps (developed in Objective-C) and hybrid apps (developed in Objective-C with web view).
There are two parts of iOS app penetration testing (pentesting). One is black box security testing where we don't have access to the source code of application and second is white box security testing, where the client provide access to the source code. Most companies are very reluctant to release their source code as it is some of their most sensitive intellectual property. In some cases, if you are a part of a product development team, you may get access to the application's source code.
It's not a must requirement to know the iOS app development for the pentesting process but it's good to have at least the basic knowledge of it. Knowing the iOS app development will make it easier to work when the client has shared their Xcode project for white box and black box pentesting. So, in this chapter, you will learn some basics of iOS app development by developing and deploying a simple Hello World application.
First things first, you will require Xcode to develop an iOS application and it will run only on a Mac machine.
Note
If you are a beginner, it is good to start with the Basics of iOS and application development section. However, if you are a pro in iOS development, you may skip this section and directly jump to the iOS security model section. Note that we will just see the overview of development and not all the concepts related to app development as our focus is understanding application level security and not learning iOS app development.
We will explain all the hardware and software requirements for security assessment of iOS application in lab setup in depth. However, in order to develop and test the iOS application, you will require the following minimum hardware and software setup to start development with this section: