GitBook: [master] 6 pages and 4 assets modified

SUMMARY.md

@@ -508,7 +508,7 @@
 * [Stealing Sensitive Information Disclosure from a Web](stealing-sensitive-information-disclosure-from-a-web.md)
 * [iOS Pentesting](ios-pentesting/README.md)
   * [Frida Configuration in iOS](ios-pentesting/frida-configuration-in-ios.md)
-  * [Jailbreaking](ios-pentesting/jailbreaking.md)
+  * [iOS Testing Environment](ios-pentesting/ios-testing-environment.md)
   * [Basic iOS Testing Operations](ios-pentesting/basic-ios-testing-operations.md)
   * [Burp Suite Configuration for iOS](ios-pentesting/burp-configuration-for-ios.md)
 

ios-pentesting/README.md

@@ -42,35 +42,7 @@ The provisioning profiles are stored inside the phone in **`/Library/MobileDevic
 
 ### 
 
-### **Simulator**
-
-All the tools required to build and support an iOS app are **only officially supported on Mac OS**.  
-Apple's de facto tool for creating/debugging/instrumenting iOS applications is **Xcode**. It can be used to download other components such as **simulators** and different **SDK** **versions** required to build and **test** your app.  
-It's highly recommended to **download** Xcode from the **official app store**. Other versions may be carrying malware.
-
-The simulator files can be found in `/Users/<username>/Library/Developer/CoreSimulator/Devices`
-
-To open the simulator, run Xcode, then press in the _Xcode tab_ --&gt; _Open Developer tools_ --&gt; _Simulator_  
-In the following image clicking in "iPod touch \[...\]" you can select other device to test in:
-
-![](../.gitbook/assets/image%20%28459%29.png)
-
-![](../.gitbook/assets/image%20%28460%29.png)
-
-### Applications in the Simulator
-
-Inside `/Users/<username>/Library/Developer/CoreSimulator/Devices` you may find all the **installed simulators**. If you want to access the files of an application created inside one of the emulators it might be difficult to know **in which one the app is installed**. A quick way to **find the correct UID** is to execute the app in the simulator and execute:
-
-```bash
-xcrun simctl list | grep Booted
-    iPhone 8 (BF5DA4F8-6BBE-4EA0-BA16-7E3AFD16C06C) (Booted)
-```
-
-Once you know the UID the apps installed within it can be found in `/Users/<username>/Library/Developer/CoreSimulator/Devices/{UID}/data/Containers/Data/Application`
-
-However, surprisingly you won't find the application here. You need to access `/Users/<username>/Library/Developer/Xcode/DerivedData/{Application}/Build/Products/Debug-iphonesimulator/`
-
-And in this folder you can **find the package of the application.**
+### \*\*\*\*
 
 ### Objective-C and Swift Basics
 
@@ -95,22 +67,163 @@ MDM profiles allow to **wipe** all the **data** if there are X **failed** passwo
 
 MDM agents will **check** also for **possible jailbreaks of the device**, as this is very dangerous state for an iPhone.
 
+## Testing Environment
+
+In this page you can find information about the **iOS simulator**, **emulators** and **jailbreaking:**
+
+{% page-ref page="ios-testing-environment.md" %}
+
 ## Static Analysis
 
-### IPA Reversing
+### Listing Installed Apps
+
+When targeting apps that are installed on the device, you'll first have to figure out the correct bundle identifier of the application you want to analyze. You can use `frida-ps -Uai` to get all apps \(`-a`\) currently installed \(`-i`\) on the connected USB device \(`-U`\):
+
+```bash
+$ frida-ps -Uai
+ PID  Name                 Identifier
+----  -------------------  -----------------------------------------
+6847  Calendar             com.apple.mobilecal
+6815  Mail                 com.apple.mobilemail
+   -  App Store            com.apple.AppStore
+   -  Apple Store          com.apple.store.Jolly
+   -  Calculator           com.apple.calculator
+   -  Camera               com.apple.camera
+   -  iGoat-Swift          OWASP.iGoat-Swift
+```
+
+### IPA Structure
 
 `.ipa` files are **zipped** **packages**, so you can change the extension to `.zip` and **decompress** them. A **complete** **packaged** app ready to be installed is commonly referred to as a **Bundle**.  
 After decompressing them you should see `<NAME>.app` , a zipped archive that contains the rest of the resources.
 
-* **Info.plist**: A file that contains some of the application specific configurations.
-* **Assets.car**: Another zipped archive that contains assets \(icons\).
-* \*\*\*\*[**Core Data**](https://developer.apple.com/documentation/coredata): It is used to save your application’s permanent data for offline use, to cache temporary data, and to add undo functionality to your app on a single device. To sync data across multiple devices in a single iCloud account, Core Data automatically mirrors your schema to a CloudKit container.
-* \*\*\*\*[**PkgInfo**](https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPRuntimeConfig/Articles/ConfigApplications.html): The `PkgInfo` file is an alternate way to specify the type and creator codes of your application or bundle.
+* `Info.plist`: A file that contains some of the application specific configurations.
+* `_CodeSignature/` contains a plist file with a signature over all files in the bundle.
+* `Assets.car`: Another zipped archive that contains assets \(icons\).
+* `Frameworks/` contains the app native libraries as .dylib or .framework files.
+* `PlugIns/` may contain app extensions as .appex files \(not present in the example\).
+* [`Core Data`](https://developer.apple.com/documentation/coredata): It is used to save your application’s permanent data for offline use, to cache temporary data, and to add undo functionality to your app on a single device. To sync data across multiple devices in a single iCloud account, Core Data automatically mirrors your schema to a CloudKit container.
+* \*\*\*\*[`PkgInfo`](https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPRuntimeConfig/Articles/ConfigApplications.html): The `PkgInfo` file is an alternate way to specify the type and creator codes of your application or bundle.
 * **en.lproj, fr.proj, Base.lproj**: Are the language packs that contains resources for those specific languages, and a default resource in case a language isn' t supported.
 
 There are multiple ways to define the UI in an iOS application: _storyboard_, _nib_ or _xib_ files.
 
-#### Binary
+#### Info.plist
+
+The information property list or `Info.plist` is the main source of information for an iOS app. It consists of a structured file containing **key-value** pairs describing essential configuration information about the app. Actually, all bundled executables \(app extensions, frameworks and apps\) are **expected to have** an `Info.plist` file. You can find all possible keys in the [**Apple Developer Documentation**](https://developer.apple.com/documentation/bundleresources/information_property_list?language=objc).
+
+The file might be formatted in **XML or binary \(bplist\)**. You can **convert it to XML** format with one simple command:
+
+* On macOS with `plutil`, which is a tool that comes natively with macOS 10.2 and above versions \(no official online documentation is currently available\):
+
+  ```bash
+  $ plutil -convert xml1 Info.plist
+  ```
+
+* On Linux:
+
+  ```bash
+  $ apt install libplist-utils
+  $ plistutil -i Info.plist -o Info_xml.plist
+  ```
+
+Here's a non-exhaustive list of some info and the corresponding keywords that you can easily search for in the `Info.plist` file by just inspecting the file or by using `grep -i <keyword> Info.plist`:
+
+* App permissions Purpose Strings: `UsageDescription` 
+* Custom URL schemes: `CFBundleURLTypes` 
+* Exported/imported _custom document types_: `UTExportedTypeDeclarations` / `UTImportedTypeDeclarations` 
+* App Transport Security \(ATS\) configuration: `NSAppTransportSecurity` 
+
+Please refer to the mentioned chapters to learn more about how to test each of these points.
+
+#### Data Paths
+
+On iOS, **system applications can be found in the `/Applications`** directory while **user-installed** apps are available under **`/private/var/containers/`**. However, finding the right folder just by navigating the file system is not a trivial task as **every app gets a random 128-bit UUID** \(Universal Unique Identifier\) assigned for its directory names.
+
+In order to easily obtain the installation directory information for user-installed apps you can use **objection's command `env`** will also show you all the directory information of the app:
+
+```bash
+OWASP.iGoat-Swift on (iPhone: 11.1.2) [usb] # env
+
+Name               Path
+-----------------  -------------------------------------------------------------------------------------------
+BundlePath         /var/containers/Bundle/Application/3ADAF47D-A734-49FA-B274-FBCA66589E67/iGoat-Swift.app
+CachesDirectory    /var/mobile/Containers/Data/Application/8C8E7EB0-BC9B-435B-8EF8-8F5560EB0693/Library/Caches
+DocumentDirectory  /var/mobile/Containers/Data/Application/8C8E7EB0-BC9B-435B-8EF8-8F5560EB0693/Documents
+LibraryDirectory   /var/mobile/Containers/Data/Application/8C8E7EB0-BC9B-435B-8EF8-8F5560EB0693/Library
+```
+
+As you can see, apps have two main locations:
+
+* The **Bundle** **directory** \(`/var/containers/Bundle/Application/3ADAF47D-A734-49FA-B274-FBCA66589E67/`\).
+* The **Data directory** \(`/var/mobile/Containers/Data/Application/8C8E7EB0-BC9B-435B-8EF8-8F5560EB0693/`\).
+
+These folders contain information that must be examined closely during application security assessments \(for example when analyzing the stored data for sensitive data\).
+
+**Bundle directory:**
+
+* **AppName.app**
+  * This is the Application Bundle as seen before in the IPA, it contains essential application data, static content as well as the application's compiled binary.
+  * This directory is visible to users, but **users can't write to it**.
+  * Content in this directory is **not backed up**.
+  * The contents of this folder are used to **validate the code signature**.
+
+**Data directory:**
+
+* **Documents/**
+  * Contains all the user-generated data. The application end user initiates the creation of this data.
+  * Visible to users and **users can write to it**.
+  * Content in this directory is **backed up**.
+  * The app can disable paths by setting `NSURLIsExcludedFromBackupKey`.
+* **Library/**
+  * Contains all **files that aren't user-specific**, such as **caches**, **preferences**, **cookies**, and property list \(plist\) configuration files.
+  * iOS apps usually use the `Application Support` and `Caches` subdirectories, but the app can create custom subdirectories.
+* **Library/Caches/**
+  * Contains **semi-persistent cached files.**
+  * Invisible to users and **users can't write to it**.
+  * Content in this directory is **not backed up**.
+  * The OS may delete this directory's files automatically when the app is not running and storage space is running low.
+* **Library/Application Support/**
+  * Contains **persistent** **files** necessary for running the app.
+  * **Invisible** **to** **users** and users can't write to it.
+  * Content in this directory is **backed** **up**.
+  * The app can disable paths by setting `NSURLIsExcludedFromBackupKey`.
+* **Library/Preferences/**
+  * Used for storing properties that can **persist even after an application is restarted**.
+  * Information is saved, unencrypted, inside the application sandbox in a plist file called \[BUNDLE\_ID\].plist.
+  * All the key/value pairs stored using `NSUserDefaults` can be found in this file.
+* **tmp/**
+  * Use this directory to write **temporary files** that do not need to persist between app launches.
+  * Contains non-persistent cached files.
+  * **Invisible** to users.
+  * Content in this directory is not backed up.
+  * The OS may delete this directory's files automatically when the app is not running and storage space is running low.
+
+Let's take a closer look at iGoat-Swift's Application Bundle \(.app\) directory inside the Bundle directory \(`/var/containers/Bundle/Application/3ADAF47D-A734-49FA-B274-FBCA66589E67/iGoat-Swift.app`\):
+
+```bash
+OWASP.iGoat-Swift on (iPhone: 11.1.2) [usb] # ls
+NSFileType      Perms  NSFileProtection    ...  Name
+------------  -------  ------------------  ...  --------------------------------------
+Regular           420  None                ...  rutger.html
+Regular           420  None                ...  mansi.html
+Regular           420  None                ...  splash.html
+Regular           420  None                ...  about.html
+
+Regular           420  None                ...  LICENSE.txt
+Regular           420  None                ...  Sentinel.txt
+Regular           420  None                ...  README.txt
+```
+
+### Plist
+
+**plist** files are structured XML files that **contains key-value pairs**. It's a way to store persistent data, so sometimes you may find **sensitive information in these files**. It's recommended to check these files after installing the app and after using intensively it to see if new data is written.
+
+The most common way to persist data in plist files is through the usage of **NSUserDefaults**. This plist file is saved inside the app sandbox in **`Library/Preferences/<appBundleID>.plist`**
+
+This data cannot be longer accessed directly via a trusted computer, but can be accessed performing a **backup**.
+
+### Binary Reversing
 
 Inside the `<application-name>.app` folder you will find a binary file called `<application-name>`. This is the file that will be **executed**. You can perform a basic inspection of the binary with the tool **`otool`**:
 
@@ -241,6 +354,7 @@ The iPhone uses the **passcode introduced by the user unlocking the device to de
 iOS uses the _**AppIdentifierPrefix**_ \(Team ID\) and the _**BundleIdentifier**_ \(provided by the dev\) to enforce **access control oven keychain items**. Then, the same team **can** **configure** **2 apps to share keychain items**.
 
 Tools like [**Keychain-Dumper**](https://github.com/ptoomey3/Keychain-Dumper) can be used to dump the keychain \(the dive must be jailbroken\).  
+You can also use `ios keychain dump` from [**Objection**](https://github.com/sensepost/objection)\*\*\*\*
 
 {% hint style="info" %}
 In **iOS earlier than 10.3**, when an application is deleted from the device, iOS **doesn't clean up the keychain**. So on these devices you can **find secrets of deleted apps**.
@@ -252,14 +366,6 @@ iOS store the cookies of the apps in the **`Library/Cookies/cookies.binarycookie
 
 To inspect the cookies file you can use [**this python script**](https://github.com/mdegrazia/Safari-Binary-Cookie-Parser).
 
-### Plist
-
-**plist** files are structured XML files that **contains key-value pairs**. It's a way to store persistent data, so sometimes you may find **sensitive information in these files**. It's recommended to check these files after installing the app and after using intensively it to see if new data is written.
-
-The most common way to persist data in plist files is through the usage of **NSUserDefaults**. This plist file is saved inside the app sandbox in **`Library/Preferences/<appBundleID>.plist`**
-
-This data cannot be longer accessed directly via a trusted computer, but can be accessed performing a **backup**.
-
 ### Custom Keyboards
 
 From iOS 8.0 Apple allows to install custom extensions for iOS like custom keyboards.  
@@ -277,17 +383,45 @@ It's possible to reset the cache in _**Settings**_ &gt; _**General**_ &gt; _**Re
 **Therefore, check always these files and search for possible sensitive information.  
 Intercepting the network traffic is another way to check if the custom keyboard is sending keystroked to a remote server.**
 
-### **Log Files**
+### **Logs**
 
 The most common ways to debug code is using logging, and the application **may print sensitive information inside the logs**.  
 In iOS version 6 and below, logs were world readable \(a malicious app could read logs from other apps and extract sensitive information from there\). **Nowadays, apps can only access their own logs**.
 
 However, an **attacker** with **physical** **access** to an **unlocked** device can connect it  to a computer and **read the logs** \(note that the logs written to disk by an app aren't removed if the app ins uninstalled\).
 
-To inspect the application logs, connect the iPhone to your computer and open _**Xcode**_ &gt; _**Devices**_ &gt; _**{Your device}**_ and you should see the live logs in the console. You can also **ssh** into the phone and run `idevicesyslog`.
-
 It's recommended to **navigate through all the screens** of the app and **interact** with **every** UI element and **functionality** of and provide input text in all text fields and **review the logs** looking for **sensitive** **information** exposed.
 
+#### Monitoring System Logs
+
+Many apps log informative \(and potentially sensitive\) messages to the console log. The log also contains crash reports and other useful information. You can collect console logs through the Xcode **Devices** window as follows:
+
+1. Launch Xcode.
+2. Connect your device to your host computer.
+3. Choose **Window** -&gt; **Devices and Simulators**.
+4. Click on your connected iOS device in the left section of the Devices window.
+5. Reproduce the problem.
+6. Click on the **Open Console** button located in the upper right-hand area of the Devices window to view the console logs on a separate window.
+
+![](../.gitbook/assets/image%20%28466%29.png)
+
+You can also connect to the device shell as explained in Accessing the Device Shell, install **socat** via **apt-get** and run the following command:
+
+```bash
+iPhone:~ root# socat - UNIX-CONNECT:/var/run/lockdown/syslog.sock
+
+========================
+ASL is here to serve you
+> watch
+OK
+
+Jun  7 13:42:14 iPhone chmod[9705] <Notice>: MS:Notice: Injecting: (null) [chmod] (1556.00)
+Jun  7 13:42:14 iPhone readlink[9706] <Notice>: MS:Notice: Injecting: (null) [readlink] (1556.00)
+Jun  7 13:42:14 iPhone rm[9707] <Notice>: MS:Notice: Injecting: (null) [rm] (1556.00)
+Jun  7 13:42:14 iPhone touch[9708] <Notice>: MS:Notice: Injecting: (null) [touch] (1556.00)
+...
+```
+
 ### Clipboard
 
 Some applications may save sensitive information inside the clipboard, which is dangerous because then a different application may sniff the clipboard and steal the data. 

ios-pentesting/basic-ios-testing-operations.md

@@ -8,7 +8,7 @@ Perform this actions having **connected** the device to the computer via **USB**
 
 The UDID is a 40-digit unique sequence of letters and numbers to identify an iOS device. You can find the UDID of your iOS device on macOS Catalina onwards in the **Finder app**, as iTunes is not available anymore in Catalina. Just select the connected iOS device in Finder and **click on the information under the name of the iOS** device to iterate through it. Besides the UDID, you can find the serial number, IMEI and other useful information.
 
-![](../.gitbook/assets/image%20%28464%29.png)
+![](../.gitbook/assets/image%20%28468%29.png)
 
 If you are using a macOS version before Catalina, you can find the [UDID of your iOS device via iTunes](http://www.iclarified.com/52179/how-to-find-your-iphones-udid), by selecting your device and clicking on "Serial Number" in the summary tab. When clicking on this you will iterate through different metadata of the iOS device including its UDID.
 

ios-pentesting/burp-configuration-for-ios.md

@@ -63,7 +63,7 @@ Starting device <UDID> [SUCCEEDED] with interface rvi0
 ip.addr == 192.168.1.1 && http
 ```
 
-![](../.gitbook/assets/image%20%28466%29.png)
+![](../.gitbook/assets/image%20%28473%29.png)
 
 The documentation of Wireshark offers many examples for [Capture Filters](https://wiki.wireshark.org/CaptureFilters) that should help you to filter the traffic to get the information you want.
 

ios-pentesting/ios-testing-environment.md

@@ -1,4 +1,50 @@
-# Jailbreaking
+# iOS Testing Environment
+
+## **Simulator**
+
+{% hint style="info" %}
+Note that a **simulator isn't the same as en emulator**. The simulator just simulates the behaviour  of the device and functions but don't actually use them.
+{% endhint %}
+
+**T**he iOS SDK simulator offers a higher-level _simulation_ of an iOS device. Most importantly, emulator binaries are compiled to x86 code instead of ARM code. Apps compiled for a real device don't run, making the simulator useless for black box analysis and reverse engineering.
+
+### **Simulator**
+
+The first thing you need to know is that **performing a pentest inside a simulator will much more limited than doing it in a jailbroken device**.
+
+All the tools required to build and support an iOS app are **only officially supported on Mac OS**.  
+Apple's de facto tool for creating/debugging/instrumenting iOS applications is **Xcode**. It can be used to download other components such as **simulators** and different **SDK** **versions** required to build and **test** your app.  
+It's highly recommended to **download** Xcode from the **official app store**. Other versions may be carrying malware.
+
+The simulator files can be found in `/Users/<username>/Library/Developer/CoreSimulator/Devices`
+
+To open the simulator, run Xcode, then press in the _Xcode tab_ --&gt; _Open Developer tools_ --&gt; _Simulator_  
+In the following image clicking in "iPod touch \[...\]" you can select other device to test in:
+
+![](../.gitbook/assets/image%20%28459%29.png)
+
+![](../.gitbook/assets/image%20%28460%29.png)
+
+### Applications in the Simulator
+
+Inside `/Users/<username>/Library/Developer/CoreSimulator/Devices` you may find all the **installed simulators**. If you want to access the files of an application created inside one of the emulators it might be difficult to know **in which one the app is installed**. A quick way to **find the correct UID** is to execute the app in the simulator and execute:
+
+```bash
+xcrun simctl list | grep Booted
+    iPhone 8 (BF5DA4F8-6BBE-4EA0-BA16-7E3AFD16C06C) (Booted)
+```
+
+Once you know the UID the apps installed within it can be found in `/Users/<username>/Library/Developer/CoreSimulator/Devices/{UID}/data/Containers/Data/Application`
+
+However, surprisingly you won't find the application here. You need to access `/Users/<username>/Library/Developer/Xcode/DerivedData/{Application}/Build/Products/Debug-iphonesimulator/`
+
+And in this folder you can **find the package of the application.**
+
+## Emulator
+
+Corellium is the only publicly available iOS emulator. It is an enterprise SaaS solution with a per user license model and does not offer any trial license.
+
+## Jailbeaking
 
 Apple strictly requires that the code running on the iPhone must be **signed by a certificate issued by Apple**. **Jailbreaking** is the process of actively **circumventing such restrictions** and other security controls put in places by the OS. Therefore, once the device is jailbroken, the **integrity check** which is responsible for checking apps being installed is patched so it is **bypassed**.
 
@@ -6,7 +52,7 @@ Apple strictly requires that the code running on the iPhone must be **signed by
 Unlike Android, **you cannot switch to "Developer Mode"** in iOS to run unsigned/untrusted code on the device.
 {% endhint %}
 
-## Root in Android Comparison
+### Root in Android Comparison
 
 iOS jailbreaking is often **compared to Android rooting**, but the process is actually quite **different**. To explain the difference, we'll first review the concepts of "rooting" and "flashing" on Android.
 
@@ -17,7 +63,7 @@ iOS jailbreaking is often **compared to Android rooting**, but the process is ac
 
 The purpose of jailbreaking is to **disable iOS protections** \(Apple's code signing mechanisms in particular\) so that **arbitrary unsigned code can run on the device** \(e.g. custom code or downloaded from alternative app stores such as Cydia or Sileo\). The word "jailbreak" is a colloquial reference to all-in-one tools that automate the disabling process.
 
-## Jailbreaking Considerations
+### Jailbreaking Considerations
 
 Jailbreaking an iOS device is becoming more and more **complicated** because Apple keeps hardening the system and patching the exploited vulnerabilities. Jailbreaking has become a very time-sensitive procedure because **Apple stops signing these vulnerable versions relatively soon after releasing a fix** \(unless the jailbreak benefits from hardware-based vulnerabilities, such as the [limera1n exploit](https://www.theiphonewiki.com/wiki/Limera1n) affecting the BootROM of the iPhone 4 and iPad 1\). This means that **you can't downgrade to a specific iOS version once Apple stops signing the firmware**.
 
@@ -29,14 +75,14 @@ iOS upgrades are based on a challenge-response process \(generating the so-calle
 **Updating the OS removes the effect of jailbreaking.**
 {% endhint %}
 
-## Jailbreak Types
+### Jailbreak Types
 
 * **Tethered** **jailbreaks** don't persist through reboots, so re-applying jailbreaks requires the device to be connected \(tethered\) to a computer during every reboot. The device may not reboot at all if the computer is not connected.
 * **Semi-tethered jailbreaks** can't be re-applied unless the device is connected to a computer during reboot. The device can also boot into non-jailbroken mode on its own.
 * **Semi-untethered jailbreaks** allow the device to boot on its own, but the kernel patches \(or user-land modifications\) for disabling code signing aren't applied automatically. The user must re-jailbreak the device by starting an app or visiting a website \(not requiring a connection to a computer, hence the term untethered\).
 * **Untethered jailbreaks** are the most popular choice for end users because they need to be applied only once, after which the device will be permanently jailbroken.
 
-## Jailbreaking Tool
+### Jailbreaking Tools
 
 Different iOS versions require **different jailbreaking techniques**. [Determine whether a public jailbreak is available for your version of iOS](https://canijailbreak.com/). Beware of fake tools and spyware, which are often hiding behind domain names that are similar to the name of the jailbreaking group/author.
 
@@ -50,7 +96,7 @@ The iOS jailbreak scene evolves so rapidly that providing up-to-date instruction
 
 > Note that any modification you make to your device is at your own risk. While jailbreaking is typically safe, things can go wrong and you may end up bricking your device. No other party except yourself can be held accountable for any damage.
 
-## Benefits
+### Benefits
 
 The most important side effect of Jailbreaking is that it **removes any sandboxing put in place by the OS**. Therefore, any **app on the device can read any file** on the filesystem, including other apps files, cookies and keychain.
 
@@ -64,7 +110,7 @@ A jailbroken device allows users to **install unapproved apps** and leverage **m
 
 {% page-ref page="basic-ios-testing-operations.md" %}
 
-## **Jailbreak Detection**
+### **Jailbreak Detection**
 
 **Several applications will try to detect if the mobile is jailbroken and in that case the application won't run**