> For the complete documentation index, see [llms.txt](https://blog.syselement.com/tcm/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://blog.syselement.com/tcm/courses/mapt/9-ios-static.md).

# 9. iOS Static Analysis

> ❗ Always refer to a HackerOne Bug Bounty program to find valid targets
>
> 🔗 [HackerOne iOS programs](https://hackerone.com/opportunities/all/search?asset_types=APPLE_STORE_APP_ID%2CTESTFLIGHT%2COTHER_IPA\&ordering=Newest+programs)
>
> * 🧪 `e.g.` - [1.1.1.1 - com.cloudflare.1dot1dot1dot1](https://hackerone.com/cloudflare) Cloudflare iOS is in scope

Unzip the `.ipa` file and check the various files inside it

* Inside the `Payload` folder check for `plist` files, `Framekworks` folder for app's source code, other `json` files on different folders
* Check for hardcoded strings in the files.

![](https://1178537843-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2KUxfxUFmy000PDT7MtM%2Fuploads%2Fgit-blob-9ac49c7b344ef8e1eae0a7635d76ca9b7681e295%2F2024-02-25_00-38-23_421.png?alt=media)

![](https://1178537843-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2KUxfxUFmy000PDT7MtM%2Fuploads%2Fgit-blob-2d6dc89538df2be3cdbcd8247fd47cf4bfed57f7%2F2024-02-25_00-47-43_422.png?alt=media)

![Info.plist](https://1178537843-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2KUxfxUFmy000PDT7MtM%2Fuploads%2Fgit-blob-99a7652486e3e40ff086f36cbe27e70933bb06cb%2F2024-02-25_00-48-49_423.png?alt=media)

Run MobSF and import the `.ipa` file into it for local static analysis

* Check the sections, look for different files, strings and look through interesting information about the app

![MobSF - 1.1.1.1.ipa](https://1178537843-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2KUxfxUFmy000PDT7MtM%2Fuploads%2Fgit-blob-57281603a6e114e581042e199280513cc1f49392%2F2024-02-25_01-25-16_424.png?alt=media)

![MobSF Application Security Scorecard - 1.1.1.1 6.23](https://1178537843-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2KUxfxUFmy000PDT7MtM%2Fuploads%2Fgit-blob-a0bb85fd60e89f15b2fa1fb1e2a18b4bcca996df%2F2024-02-25_01-36-57_428.png?alt=media)

![](https://1178537843-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2KUxfxUFmy000PDT7MtM%2Fuploads%2Fgit-blob-6569bac2ef651bbf62a1583fd90717f3addd2b11%2F2024-02-25_01-28-44_425.png?alt=media)

![](https://1178537843-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2KUxfxUFmy000PDT7MtM%2Fuploads%2Fgit-blob-3e6fbc50b8ebcd1f8246835b5818082f6a91ef0d%2F2024-02-25_01-29-28_426.png?alt=media)

![](https://1178537843-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2KUxfxUFmy000PDT7MtM%2Fuploads%2Fgit-blob-e0a066040ad109d4f4fbd3467c373e87be9256a9%2F2024-02-25_01-31-45_427.png?alt=media)

***