Objection has become a standard tool in iOS application security testing because it wraps Frida's dynamic instrumentation capabilities into an accessible, interactive runtime exploration shell, removing much of the friction that used to require custom scripting for common tasks. From bypassing SSL pinning to dumping keychain contents and exploring an app's internal data structures at runtime, Objection covers a large share of what an iOS assessment needs without requiring a jailbroken device in every scenario. This guide walks through practical, hands-on use of Objection for authorized iOS security testing. Mobile application assessments run by Sagefox Cybersecurity rely on this same Objection-driven workflow as a core part of iOS testing methodology.
Setting Up an iOS Testing Environment
Jailbroken Versus Non-Jailbroken Testing
Objection can operate against both jailbroken devices and, with some limitations, non-jailbroken devices through repackaging the target IPA with the Frida gadget embedded directly. A jailbroken device provides more complete access and is generally preferred for thorough assessments, while the repackaging approach is useful when testing needs to occur on a device that cannot or should not be jailbroken.
Installing Objection and Frida Tools
pip install objection frida-tools
Confirm the installation and check compatibility with the current Frida server version running on the target device.
objection version
frida --version
[cta]
Installing Frida Server on a Jailbroken Device
On a jailbroken device, Frida server typically installs through Cydia or Sileo by adding the appropriate repository, or manually by pushing the binary directly via SSH.
scp frida-server-16.1.4-ios-arm64 root@<device_ip>:/usr/sbin/frida-server
ssh root@<device_ip> "chmod +x /usr/sbin/frida-server && /usr/sbin/frida-server &"
Repackaging an Application for Non-Jailbroken Testing
Injecting the Frida Gadget into an IPA
For testing on non-jailbroken devices, Objection can automate the process of extracting an IPA, injecting the Frida gadget, and resigning the package for installation.
objection patchipa --source target_app.ipa --codesign-signature "Apple Development: Your Name (TEAMID)"
This produces a modified IPA that loads the Frida gadget automatically on launch, allowing dynamic instrumentation without requiring the device itself to be jailbroken.
[cta]
Sideloading the Patched Application
Once patched and signed, the modified IPA can be installed onto the test device using a sideloading tool.
ideviceinstaller -i target_app_patched.ipa
Connecting Objection to a Running Application
Attaching to a Process by Name
With Frida server running on the device and the target application launched, Objection connects directly to the running process.
objection -g com.target.app explore
This opens an interactive shell within the context of the running application, providing access to the full range of Objection's exploration commands.
[cat]
[cta]
Confirming the Connection and Basic Environment Details
Once connected, a few basic commands confirm the environment and application details before proceeding with deeper testing.
ios info binary
ios bundles list_bundles
[cta]
Bypassing SSL Pinning
Why This Is Usually the First Step
Certificate pinning prevents traffic interception through a standard proxy like Burp Suite, which blocks nearly every other useful testing activity until it is addressed. Bypassing pinning is typically the first action taken in any iOS assessment involving network traffic analysis.
Disabling SSL Pinning Through Objection
ios sslpinning disable
This command attempts to hook and neutralize common SSL pinning implementations automatically. For applications using custom or less common pinning libraries, this automatic bypass may require supplementing with a manual Frida script targeting the specific pinning implementation identified through static analysis.
Verifying the Bypass Succeeded
After disabling pinning, configuring the device to route traffic through a proxy like Burp Suite and confirming that HTTPS traffic is now visible in plaintext within the proxy's interface confirms the bypass worked.
[cta]
Exploring the Application's Keychain
Why Keychain Analysis Matters
iOS applications frequently store sensitive data such as authentication tokens, session identifiers, and sometimes credentials directly in the device keychain, which is intended to be a secure storage mechanism but is not immune to review during an authorized assessment.
Dumping Keychain Contents for the Target Application
ios keychain dump
This exports all keychain entries accessible to the current application into a readable format, revealing exactly what sensitive data the app has chosen to persist and how.
Reviewing Keychain Data for Improperly Protected Secrets
ios keychain dump --json keychain_dump.json
cat keychain_dump.json | jq '.[] | select(.Data | test("token|password|secret"; "i"))'
Filtering the dumped keychain data for likely sensitive field patterns quickly surfaces entries worth investigating further, particularly any authentication token stored without the appropriate accessibility restriction limiting it to when the device is unlocked.
[cta]
Exploring the Application's File System
Listing Application Directories
Objection provides direct access to the application's sandboxed file system, useful for identifying insecurely stored data outside the keychain.
ios file ls /var/mobile/Containers/Data/Application/<app-guid>/Documents
Downloading Files for Offline Analysis
ios file download /var/mobile/Containers/Data/Application/<app-guid>/Documents/user_data.db ./local_copy.db
Pulling application-generated files for offline analysis allows deeper inspection with tools like a SQLite browser, revealing whether locally stored databases contain unencrypted sensitive data.
[cta]
Searching for Sensitive Data Across the File System
ios file ls / --recursive | grep -i "cache\|tmp\|log"
Cache, temporary, and log directories frequently retain sensitive data longer than developers intend, making them worth specifically targeted review beyond the application's primary data directory.
Exploring Runtime Classes and Methods
Listing Loaded Classes
Understanding an application's internal structure at runtime helps identify interesting methods worth hooking for deeper analysis.
ios hooking list classes
Searching for Classes by Name Pattern
ios hooking search classes Auth
Filtering the potentially long list of loaded classes down to ones matching a relevant keyword, such as authentication-related class names, speeds up identifying the most promising targets for further hooking.
[cta]
Hooking a Specific Method to Inspect Its Behavior
ios hooking watch method "-[AuthManager validateToken:]" --dump-args --dump-return
This watches every call to the specified method, logging the arguments passed in and the value returned, which is particularly useful for understanding how an application validates authentication tokens or processes sensitive input without needing to write a custom script for every individual method of interest.
Bypassing Jailbreak Detection
Identifying Jailbreak Detection in Place
Many applications implement jailbreak detection specifically to prevent security testing on jailbroken devices, checking for the presence of common jailbreak artifacts like Cydia or altered system file permissions.
Disabling Detection Through Objection
ios jailbreak disable
This attempts to bypass common jailbreak detection techniques automatically, though applications using more sophisticated or custom detection logic may require identifying the specific check through static analysis and hooking it directly with a custom Frida script.
[cta]
Testing Biometric Authentication Bypass
Why Biometric Bypass Testing Matters
Applications relying on Face ID or Touch ID for sensitive actions sometimes implement the check in a way that can be bypassed if the underlying authorization logic does not properly validate the biometric result server-side or through a secure enclave-backed mechanism.
ios ui biometrics_bypass
This attempts to force a successful biometric authentication result without the device's actual biometric sensor being used, revealing whether the application's sensitive functionality properly depends on a secure authentication chain or can be bypassed through client-side manipulation alone.
Documenting Objection-Based Findings
Demonstrating Concrete Impact for Each Finding
As with any dynamic analysis tool, the value of Objection's output comes from what it demonstrates, not the raw commands run. A keychain dump revealing an unprotected authentication token, or a successful SSL pinning bypass that exposes previously hidden API structure, should be documented with clear before-and-after evidence showing exactly what was recovered and how.
Mapping Findings to Realistic Attack Scenarios
Framing findings around realistic scenarios, such as a lost or stolen device with an attacker able to extract keychain contents without needing a passcode bypass, helps development teams understand the practical risk rather than treating a technical finding as abstract. This is the kind of scenario-driven reporting that assessments through Sagefox Cybersecurity are built around, ensuring iOS findings translate into fixes the development team can prioritize appropriately.
Common Mistakes When Testing iOS Apps with Objection
Relying Entirely on Automatic Bypass Commands
Objection's automatic SSL pinning and jailbreak detection bypass commands cover common implementations well but do not guarantee success against custom or heavily obfuscated logic. When an automatic bypass fails, falling back to manual static analysis and a custom Frida script remains necessary rather than concluding the app has no vulnerability in that area.
Testing Only on a Single iOS Version
Application behavior, particularly around biometric authentication and keychain accessibility settings, can vary meaningfully across iOS versions. Testing exclusively on one OS version may miss behavior differences relevant to the broader user base running older or newer versions.
Overlooking Non-Keychain Sensitive Storage
Focusing exclusively on keychain analysis while overlooking application file system storage, including cache and temporary directories, misses a meaningful category of sensitive data exposure that many applications are equally guilty of mishandling.
Key Takeaways
Objection consolidates a wide range of iOS dynamic analysis capabilities into an accessible interactive shell, covering SSL pinning bypass, keychain and file system exploration, runtime method hooking, and jailbreak or biometric bypass testing without requiring extensive custom scripting for common tasks. The tool accelerates testing significantly, but the real value still comes from a tester's judgment in interpreting what gets found, verifying it demonstrates genuine impact, and mapping it back to a realistic attack scenario a development team can act on.
If your organization needs a thorough iOS application security assessment covering runtime behavior beyond what static analysis alone can reveal, the team at Sagefox Cybersecurity can help identify what your app actually exposes at runtime and how to fix it.
