Lesson 1.65: Inside an iPhone app (IPA)
An iOS app ships as an IPA, also a ZIP archive, with a .app folder inside Payload/. Its Info.plist plays the role of Android's manifest: identity, minimum iOS version, URL schemes, the reasons shown to users for each permission, and App Transport Security (ATS), which requires HTTPS unless the app opts out. The provisioning profile and entitlements say what the app may do. In the lab you open Northwind Shop's IPA, convert its binary Info.plist, find that ATS has been switched off for every domain, read the permission texts, and confirm the build isn't a debug build.
15 min
You will learn to
- Explain what an IPA contains
- Convert a binary plist
- Read App Transport Security settings
- Review permission usage descriptions
- Check get-task-allow in the provisioning profile
Key terms
- IPA
- iOS App Store Package: a ZIP with Payload/<Name>.app inside.
- Info.plist
- The app's property list: identity, versions, URL schemes, permission texts, ATS.
- App Transport Security (ATS)
- iOS policy requiring HTTPS with TLS 1.2+ and forward secrecy for app connections.
- Usage description
- The sentence shown when iOS asks the user for a permission.
- Provisioning profile / entitlements
- Apple-signed file listing the app ID, team and entitlements (capabilities) the app may use.
← The psychology of social engineering · All lessons · Network devices: network cards, switches, routers and access points →