Beginners Guide to iOS Testing Jailbreak, SSL Bypass & Burp

Hey everyone, it's been a while! Welcome to the finding your first bug series! This week I'm going to show you the basics of iOS testing, this is part one of this series and we'll be covering the absolute basics of how to jailbreak a device, bypass the SSL pinning, and get the device to traffic through Burp on another device.
Did you know this episode was sponsored by Intigriti? Sign up with my link go.intigriti.com/katie I'm so pleased with everyone's positive response to the Intigriti sponsorship and I'm so pleased you folks are finding bugs and even finding your first bugs! Thank you for being awesome!
So to get started with iOS hacking you don't need any specific skills, we're going to go through it all! You will need an iOS device that you're okay to jailbreak, I'm using an iPad Mini 4, but many devices are vulnerable to checkra1n, if you're on windows you can use unc0ver as your jailbreak too. Coming up soon in this guide, the live demo stream next week and then frida and more advanced iOS bugs. See you all soon!
Checkra1n: checkra.in
SSL Kill Switch: github.com/nabla-c0d3/ssl-kil...
Reading ahead? Here's what we'll cover next time:
Frida: frida.re/docs/ios/
Inspecting Apps: resources.infosecinstitute.co...
Objection: www.allysonomalley.com/2018/1...
If your internet isn't stable, iproxy setup to proxy over USB: spaceraccoon.dev/from-checkra...
XSS in an iOS app: www.allysonomalley.com/2018/1...
Top mobile app bugs: www.allysonomalley.com/2020/0...
Credential hunting: spaceraccoon.dev/low-hanging-...

[@slaybomb96]

video starts at 3:58

[@AjayKumar-xl4jc]

Thanks for this video

[@netbin]

I am glad that bug bounty community is focusing on hacking that apple gadgets, its time to do that already. Thanks for great content Katie!

[@foxgameplay5449]

wow the way you explain is very easy to understand. i hope more tutorials on it. i am on 14.4.2 no jailbreak yet. sad

[@sy-gamer9556]

and thanks katie for the wonderfull video

[@InsiderPhD]

You're welcome! Thank you for enjoying it :)

[@ismailramzan8927]

It's really amazing 😍. I hope so You will get to 100k very fast. 🙃

[@InsiderPhD]

Thank you so much 😀 100k soon I hope!

[@adityazalte152]

Videos are awesome

[@ca7986]

Waiting for this!

[@InsiderPhD]

I hope I did not disappoint!

[@ca7986]

@@InsiderPhD you never! I love your content. You're awesome!

[@shantanukulkarni1742]

Waiting for complete series on IOS pentesting from scratch to pro.. thanks for video.

[@InsiderPhD]

This is only part 1, stay tuned for live iOS hacking, Frida + some demo scripts with Frida for bug hunting!

[@AvinashSingh-vj3rk]

Nice video

[@xnl-h4ck3r]

Hi Katie. Thanks loads for the video (and all the others!). I was able to follow through and successfully jailbreak my iPad Mini 3 and get traffic through Burp on my iMac... all was great!... but My iPad then ran out of battery and restarted with checkr41n missing and nothing worked. I have tried many times to repeat the setup, but now my iPad will not go into DFU mode and checkr41n fails every time. I was wondering if you have come across this issue with your iPad, or if you know what I need to do to get things working again? Many thanks ...and Happy Birthday! :)

[@prembharwani]

Hey Katie , It would be really helpful if you do Android series .I am sure Your videos for Android will help a lot :)

[@InsiderPhD]

Yup this is upcoming, I'm just more familiar with iOS and I know few people talk about it!

[@theanonymous9110]

Going back to frida as burp works on other devices but my iPhone the only device I’ve got to mess around with today

[@ca7986]

❤️

[@siratsami71]

Thank you very much but how can I test api s in ios applications? I have jailbreaked my ios and ssl kill switcher but I can't capture the application api s only website requests

[@MrPaddy35]

very good video tbh i struggled to do this my first time ever it took me hours

[@InsiderPhD]

Thank you so much, I had the same experience, struggling to get it and realising that it really can be very straightforward!

[@MrPaddy35]

@@InsiderPhD yep thanks for quick recap i will say :) worth watching

[@aneeshnadh5377]

Good video, can you do a video on android app bug bounty?

[@InsiderPhD]

Soooooon! I promise, it's in the pipeline I just haven't got to it yet!

[@ShortKenshi]

I had some issues on IOS 13.3 and this solved them: Update burp so you can disable TLSv1.3 in: Proxy > Options > Proxy Listener > Edit the one you are using > TLS Protocols > Use Custom Protocols Trust the certificate as root certificate on your phone in: General > About > Certificate Trust Settings

[@InsiderPhD]

Great advice! I will make sure to highlight this in the description!

[@ArtBySujan]

I have a iPhone 11 it can possible on it

[@sy-gamer9556]

when my device enters recovery mode my linux device gives the message didnt find the device how to fix it can anyone help

[@theanonymous9110]

I can’t get my network to work after entering my proxy I got from the search all tab in options in burp? I tried localhosts, my ip, my main ip, the ip in WiFi networks and burps set to accept all connections but on iOS device no internet now..

[@nikhilsawant1106]

Please do android series as well. Thanks

[@InsiderPhD]

Coming soon, I'm more familiar with iOS so this one came out first, Android will cover emulator setup + all the same stuff!

[@6cylbmw]

Are we required to have a macos for this? I have done some research on my own for starting mobile hacking on iOS and I lived with the idea that I need a macOS for this.

[@InsiderPhD]

No! On windows, you can use unc0ver to jailbreak and you're all good! You can totally do this all on windows without OSX!

[@6cylbmw]

@@InsiderPhD Perfect, I really wanted to get started into mobile app hacking, but never had the patience to start it. Meanwhile I have started searching for a cheap second hand iphone 6s, tomorrow buying it :). Thanks Katie for your online presence.

[@Demonking440]

How is it going man?

[@jonnysokkoatduckdotcom]

From i think it is 6:32 in the video the video sound goes way down

[@anonymous-ve9bc]

hello i dont see ssl Kill Switch in setting

[@ranjithkumarmayavan9701]

what's the difference between testing an API in IOS and Android..

[@jonnysokkoatduckdotcom]

How come intIgriti website is not incrypted? Its NOT HTTPS

[@adityazalte152]

How to use Metaspoit framework in bug hunting ..like at hackerone ,Bugcroud etc.

[@InsiderPhD]

Metasploit isn't really used in bug hunting - it's more commonly used for pen testing, we will usually use burp!

[@ArkanoidGaming]

Hey Katie , I had a doubt recently , since you are experienced in iOS app pt , I wanted to know whether an iPod Touch 5th Gen would be good to do pentesting on iOS apps? Please do reply to this comment as I have been searching for answers everywhere

[@InsiderPhD]

I don't know sorry, you'll have to see what version of iOS it runs and see if it can run iOS13+, and if it can be jailbroken via canijailbreak

[@ArkanoidGaming]

@@InsiderPhD it has iOS version till 9.3.5 , i cant jailbreak it , but the main issue is , will it be useful for iOS pentesting

[@sy-gamer9556]

when will you release your next video on ios app testing??

[@InsiderPhD]

Soon I'm just taking a break at the moment :)

[@jonnysokkoatduckdotcom]

At 12:11 you video cuts off in the middle of you explaining why you should NOT DO SOMETHING! and we never find out what it is that we SHOULD NEVER DO! what is it that we should NEVER DO?!

[@dontaskme1625]

what is the Ios emulator talked about at 4:20 ?

[@InsiderPhD]

The emulator is: www.grinningsoul.com/ developed by twitter.com/daeken !

[@Mybabyworld0722]

How to stop ssl certificate bypassing after implementation in ios?

[@InsiderPhD]

Same as in the video but there’s ssl killswitch 3 now

[@jonnysokkoatduckdotcom]

Wait, that was it? It kind of just ended.

[@razexrazex]

Important thing to know, SSH open by default username/password remember to change it.

[@InsiderPhD]

I should have mentioned this! Absolutely ensure that you only use your home network or change the password!

[@boogleapp8638]

Hey! Are you still active? I need to get a API Request, if you know how. Let me know, I'll tell you what I need.

[@cloufish7790]

12:10 this is pure gold xD. Hackers cut off the recording! 😱

[@InsiderPhD]

Sorry! I still learning a new piece of editing software, this KZbin channel is a bit of a one man band! I don't really have any experience in editing so sometimes I make mistakes. I'm a hacker not a video editor! Just trying to do my best

[@cloufish7790]

@@InsiderPhD np 🙂

[@salahhisham3467]

hey Katie, I'm A student Looking For Part time job i have Some Skills in Web Development like Html,css,js,jquery,ajax,php,mysql,oop,designpatttern my Question is What will be less comptetive and i can make few money from it should i Start Bugbounty ?or Continue in Web development ? i have 2 month only left as free time to develope my skills and i want to use them in a right way for me i like both bug hunting,web development but i feel both of them is very comptetive nowdays so please i want your help and your point of view ,thanks in advance

[@InsiderPhD]

Do both! A web developer with security skills is such a big bonus, or a bug bounty hunter with web dev knowledge can find really unique bugs! Keep on web development, honestly it's a skill that will be in demand a long time and you can develop your security skills around your web dev ones. I started out doing web development!

[@salahhisham3467]

@@InsiderPhD oh that's Cool i will try to do both ❤

[@sanallince3547]

Hey katie, I am bigineer to IOS world, in my proffesion i need to jailbreak a new iphone for testing ios applications. I research a lot but i confused, can you suggest a iphone in 2023 to vulnerable checkra1n or any other softwares. Your reply is more value at this movement. I need help : )

[@InsiderPhD]

So do I :P I still can’t get my iPad back into a security research state since it accidentally updated to iOS 16

[@sanallince3547]

@@InsiderPhD ok, if it's possible to jailbreak IOS 15 or 16

[@cardzzz6585]

Awesome video! a couple editing hiccups, but who cares!

[@InsiderPhD]

Sorry about that, new editing program, still learning!

[@jonnysokkoatduckdotcom]

A HACKING Website NOT HTTPS?

[@InfoSecIntel]

Hey, i tried to ask this by tweeting you on Twitter a while ago but im not the best ‘tweeter’ so maybe i did it wrong. Anyway, This is the third time arjun has found this parameter on three totally different websites. The parameter is p4ssw0rD. Only this parameter will cause a 403 forbidden response no matter what the value is. Im not sure because its been a while since the last time this happened, but it may be that all of these sites are running on cloudfare. I’ve tried googling what this strange parameter is for with no luck. Even if you dont have the answer, I thought you may be interested to hear about this behavior. Thank you!

[@InsiderPhD]

It might have been filtered, I get a lot of notifications so I have to manage my notifications so if you had a new account/default profile pic/no phone number I may not have seen it. That's very interesting! I've not seen that behaviours before!

[@MrPaddy35]

its not cyndia katie lol its cydia

[@InsiderPhD]

Omg I'm such a smooth brain with pronunciation, it's ffuf all over again

[@MrPaddy35]

@@InsiderPhD haha :) it was funny tho , didnt meant to be offensive

[@dontaskme1625]

make the sponsor part shorter, 3 minutes is extremly long IMHO

[@InsiderPhD]

Thank you for the feedback! I appreciate your thoughts and I will see if I can make any changes to the sponsorship. I should say that a sponsorship really does help me invest in the channel, and this channel does not make enough to be able to afford things like the improved audio setup without it, so I'm very fortunate in that regard!

[@InsiderPhD]

I do take this feedback seriously and I will figure out how to improve for the next sponsorship round :)

[@AjayKumar-xl4jc]

Thanks for this video