Static analysis of an IPA: Info.plist, entitlements and bundled files
You examine an iPhone app package without running it: you read Info.plist settings, entitlements, the provisioning profile, embedded frameworks and files, and find and report secrets and risky settings.
Level 201 · 22 lessons · 18 practice labs
Lessons
Unpacking the package
- The structure of an IPA: Payload, the .app bundle, frameworks
- plist formats: reading XML and binary plists
- Identity fields in Info.plist: bundle ID, version, minimum iOS
- Store encryption: why we work with packages built for training
- Short task: tabulate bundle ID, version and minimum iOS for three IPAs
Info.plist settings
- App Transport Security exceptions
- Usage description strings: does the request match the function
- URL schemes, universal links and queried schemes
- Background modes and file sharing settings
- Reading the privacy manifest file
- Short task: pull five findings from an Info.plist and rank them
Signature and entitlements
- Extracting entitlements from the binary
- Risky entitlements: get-task-allow and wide keychain groups
- Reviewing the embedded provisioning profile: distribution type and expiry
- The code signature folder and the resources it covers
- Short task: find the development entitlement left in a release package
Bundled files and the binary
- Secrets in the bundle: plist, JSON and service configuration files
- Frameworks and SDK inventory
- A first look at the binary: architecture, linked libraries, strings
- Binary protections: PIE, stack canaries, ARC
- Short task: find the embedded service key and the test server address in an IPA
Capstone
- Capstone: write the IPA static review report for an insurance app
Practice labs
- Open an IPA and find the .app bundle: List the contents of the Payload folder.
- Convert a binary plist to readable form: Convert Info.plist to XML and extract the identity fields.
- Script an identity table for three IPAs: Prepare a script that writes bundle ID, version, minimum iOS and framework count to CSV.
- Find the URL schemes in Info.plist: List the schemes the app registers.
- Compare usage descriptions with function: Match the permissions the Ayçiçeği Gıda ordering app asks for to its feature list and report the excess.
- Extract and rate five findings from an Info.plist: Write findings from ATS, file sharing, background modes and schemes, with severity and fix.
- Extract the entitlements of a release package: Write the entitlement list to a file.
- Find the development entitlement left in a release: Prove which package has get-task-allow left on.
- Cross-check the embedded profile with the signature: Compare the profile's distribution type, expiry and signing identity and write the inconsistency as a finding.
- List the configuration files in the bundle: Find the plist and JSON files.
- Find the embedded service key and test address: Search the service configuration file and the strings for secrets.
- Recommend platform-appropriate fixes for three secrets: State with reasons whether each secret should move to the server or be restricted.
- List the embedded frameworks: Extract the libraries in the Frameworks folder and their versions.
- Check the binary's protection flags: Verify PIE, stack canaries and ARC use with llvm-otool.
- Compare the SDK inventory with the privacy manifest: Match the SDKs in the bundle to the declarations in the manifest file and find the undeclared one.
- Write an IPA finding as evidence, impact, fix: Turn the ATS exception into a three-part finding.
- Merge Android and iOS findings in one table: Split the findings from one app's two packages into shared and platform-specific.
- Write the IPA report for an insurance app: Deliver the static review report with a summary, six findings and the fix order.
About this course
You examine an iPhone app package without running it: you read Info.plist settings, entitlements, the provisioning profile, embedded frameworks and files, and find and report secrets and risky settings.
What you will learn
- Unpacking the package
- Info.plist settings
- Signature and entitlements
- Bundled files and the binary
- Capstone
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.