Start with the mental model
Before you ever try to test an iOS app, you need to understand what iOS actually is. This is the foundation course — it comes before the advanced "iOS Application Security" course. Here you learn how the platform is built and how to prepare a safe lab, all on your own devices. We stay conceptual and setup-focused: no real exploitation.
How each lesson works
There are no videos. You learn by reading the theory, then looking at the tools and the method, then doing the challenge yourself. Stuck? Every challenge has a Show solution. Read, then do — that's how it sticks.
The stack, from the bottom up
- XNU / Darwin kernel — iOS sits on the same core (XNU kernel, Darwin userland) that macOS uses. It owns the hardware and enforces every rule above it.
- The app sandbox — each app runs isolated in its own container and cannot freely read other apps' data or the wider system.
- Code signing — every piece of code that runs must be cryptographically signed and trusted by Apple, so unsigned or tampered code simply won't launch.
- Secure Enclave — a separate hardware security processor that guards keys, Face ID/Touch ID data and cryptographic secrets, isolated from the main CPU.
Together these make iOS very hard to tamper with — which is exactly why testing it takes preparation.
🛠 Tools
- Your own iPhone or iPad (a device you own).
- A Mac (needed later for Xcode) — optional for this first lesson.
⚙️ Method
- Read the four layers above and picture how a tap on an app flows down to the kernel and back.
- On your own device, open Settings > General > About and note the iOS version and model.
- Write one sentence explaining, in your own words, why the sandbox stops one app reading another's files.
🎯 Challenge: On a device you own, find your exact iOS version and model, then explain in one sentence each what the sandbox and code signing protect against.
Show solution
- Version/model: Settings > General > About → read "Software Version" and "Model Name".
- Sandbox: it isolates each app in its own container, so a malicious or buggy app can't read another app's data or roam the filesystem.
- Code signing: only code signed and trusted by Apple runs, so an attacker can't quietly swap in modified or unsigned code.
⚖️ For authorized, legal use only — practise on your own devices, apps and lab.
What's in iOS for Beginners
- 1. How iOS Works — Architecture and the SandboxFree
- 2. The iOS Security Model🔒 Foundations
- 3. Apps, IPA and the App Store Model🔒 Foundations
- 4. Settings, Profiles and Developer Mode🔒 Core
- 5. Connecting a Device to Your Mac (Xcode)🔒 Core
- 6. Jailbreak — What It Is and the Risks🔒 Core
- 7. Simulator vs Real Device for Testing🔒 Core
- 8. A First Look at App Files and Structure🔒 Core
- 9. Ethics and Legal Boundaries🔒 Ethics
- 10. Keychain, Data Protection & the Secure Enclave🔒 Core
- 11. OWASP MASVS & MASTG — the Testing Map🔒 Foundations
- 12. Where to Go Next🔒 Next Step
Continue in the interactive course reader →