Lion Cipher Lab

Analyze an iOS app with MobSF (static analysis of a deliberately-vulnerable IPA)

• AppSec / DevSecOps
• Intermediate
• ~60 min
• Free · no account required

Why it matters

Billions of people run iOS apps, and almost no one -- including plenty of working security people -- has ever looked inside one. iOS has a reputation for being a closed box, and that reputation scares beginners off: the usual advice is that you need a Mac, an Apple Developer account, and a jailbroken iPhone before you can even start. For STATIC analysis, none of that is true. An iOS app ships as an IPA -- a single package file -- and inspecting that file without running it tells you an enormous amount: does the app force secure HTTPS or does it quietly allow plain HTTP; was the binary…

What you'll learn

• understanding what an iOS app package (an IPA) is and what static analysis can and cannot tell you, from zero
• starting MobSF (Mobile Security Framework) in Docker with a single command and opening its dashboard
• getting a SAFE, legal iOS target: the deliberately-vulnerable DVIA-v2 IPA, with no iPhone and no jailbreak needed
• uploading an IPA to MobSF and producing a full rendered static-analysis report
• reading the Info.plist: bundle id, URL schemes, and declared capabilities
• reading App Transport Security (ATS) settings and telling a safe config from an insecure-HTTP exception
• reading entitlements and understanding what special capabilities an app has been granted
• reading binary hardening flags -- PIE, stack canary, and ARC -- and knowing what a missing one means
• spotting hardcoded secrets and interesting strings in the report
• mapping each finding to the OWASP MASTG/MASVS category that names it

Steps in this lab

1. What this lab is, and why it is legal, safe, and needs no iPhone
2. The words you need first: IPA, Info.plist, ATS, entitlements, PIE/canary/ARC (from zero)
3. Make sure Docker is running
4. Start MobSF with one command and open it in your browser
5. Get the DVIA-v2 IPA (no iPhone, no jailbreak)
6. Upload the IPA and run the static-analysis scan
7. Read the Info.plist and the App Transport Security (ATS) settings
8. Read the entitlements and the binary hardening flags (PIE, stack canary, ARC)
9. Find hardcoded secrets and interesting strings
10. When static analysis is the right move -- and where it stops (dynamic/Frida)
11. How a pro triages a MobSF report instead of drowning in it

Open the full interactive lab →