lab Challenge series

iOS Application Exploitation Challenges

Tackle security vulnerabilities in iOS apps, and challenge your iOS reverse engineering prowess.
Designed for:
  • iOS security specialists
  • Bug bounty hunters
  • Security engineers and developers
Write your awesome label here.

Explore the Challenges

What’s Inside?

A collection of fun and diverse vulnerable iOS applications purpose-built to challenge and sharpen your skills.

FridaInTheMiddle: Stay attached, stay invisible

Welcome to FridaInTheMiddle, a Swift-based iOS application that’s extremely sensitive to uninvited interference. It comes equipped with active runtime tamper detection that watches for signs of Frida—whether through suspicious ports, injected dylibs, or unauthorized hooks.

Objective

Keep the app running while Frida is attached, and intercept the argument passed to dummyFunction(flag:) to extract the flag.

Restrictions: Using Static reverse engineering is not allowed—you must rely on dynamic analysis to retrieve the flag during execution.

Flag Format: CTF{...}

SwizzleMeTimbers: Change the code, unlock the gold

SwizzleMeTimbers is a pirate-themed iOS app with a secret buried deep inside its view controller. A simple button reads “Unlock Treasure”, but it’s protected by a method that always returns false—unless you’re crafty enough to change its behavior at runtime.

Objective

Use method swizzling to unlock the hidden flag. Bypass the app’s logic using dynamic instrumentation tools (e.g., Frida or Objective-C runtime) to change the behavior of a function at runtime and trigger the correct flag path.

Restrictions: You must perform runtime manipulation to change how the app behaves.

Flag Format: CTF{...}

TraceTheMap: Not all who spoof are lost… unless we catch them.

TraceTheMap is an iOS location-based challenge where you must collect 5 hidden map markers scattered within a 1 km radius. Each collectible is worth 100 points—and you need all 500 to win.Get within 50 meters of each collectible to score. Sounds simple? Not so fast.

While spoofing your GPS might seem like the obvious path, this app comes with a few built-in countermeasures to detect foul play. From unexpected location sanity checks to behavioral traps, it won’t be a walk in the park—even if you fake it.

Objective

Score 500 points by collecting all 5 hidden markers using clever spoofing, patching, or dynamic instrumentation—without triggering the anti-cheat logic.

Restrictions:

  • The flag is awarded only after scoring 500 points.
  • The app performs runtime checks to detect spoofing and other manipulations.


Flag Format: CTF{...}

ClearRoute: Not Really

ClearRoute is an iOS app designed to test your ability to intercept sensitive data—without getting caught. The app attempts to send a POST request containing a hidden flag.

Objective

Intercept the outgoing request to retrieve the flag.  Modify, patch, or instrument the app to disable or evade any checks, allowing the request to go through. Intercept the POST data to extract the flag from the constructed key.

Intercept smartly—this route’s under surveillance. 🛰️

TrustFall: One bad link, and it all collapses

TrustFall is a secure iOS workspace app that uses deep linking to load trusted content inside an embedded browser. It claims to only open links from approved domains—but its defenses aren’t as strong as they seem. Direct access to untrusted domains is blocked—unless you find a loophole.

Objective

Find a way to trick the app into loading an unintended URL and triggering the hidden flag.

Use deep link manipulation to bypass the app’s domain filtering and get it to load a crafted URL.

TraceTheChat: Read between the (runtime) lines.

TraceTheChat is a seemingly innocent messaging app—type a message, hit send, and it gets routed to a mysterious contact. But beneath the surface, the message travels through an obfuscated class that hides the details from plain sight.

Objective

Use Frida to dynamically trace and intercept the actual message being sent at runtime.

Identify the class or method responsible for dispatching messages, hook into it with Frida, and extract the message contents and recipient live as they’re sent.

Restrictions:

  • The flag is embedded in a message sent to a contact—but only visible through instrumentation.
  • You cannot statically extract the flag from the app binary.

WhereAmIReally: Location is everything… but proof is better.

WhereAmIReally is an iOS app that only reveals the flag if you’re in the right place—physically. It checks your GPS coordinates against a geofenced area and validates the authenticity of your location before granting access.

But this app doesn’t just trust what you feed it. It has some additional checks in place.

Objective

Convince the app you’re standing in the right spot—even if you’re not.

Bypass the app’s verification logic and retrieve the flag by simulating a trusted presence at a specific real-world location.

Restrictions: The flag is revealed only if your location is verified and accepted.

BadPreference: Your settings say more than you think.

BadPreference looks like a clean, production-ready app—until you flip the right switch. Somewhere in the app’s internal preferences lies a hidden mode that unlocks a secret flag, but it won’t reveal itself through the UI or static strings alone.

Objective

Discover and activate the app’s hidden debug mode to extract the flag.

Manipulate the app’s internal settings or runtime behavior to enable a hidden debug state and uncover the embedded flag.

Restrictions:

  • The flag only appears when the app believes it’s running in debug mode.
  • Static reverse engineering alone won’t trigger it—you need to modify app state or interact with runtime data.
  • No direct UI controls reveal or toggle the hidden mode.

BackSync: Some configs do more than just sync

BackSync appears to be a straightforward profile viewer with minimal functionality. However, beneath its unassuming interface lies a background process that periodically fetches remote configurations. These configurations can influence the app’s behavior in unexpected ways.

Objective

Investigate the app’s background activities and determine how to manipulate its behavior to your advantage.

Analyze the app to understand its configuration fetching mechanism. Craft a remote configuration that causes the app to perform an unintended action, leading to the retrieval of the hidden flag remotely.

Restrictions: The flag resides in a local file within the app’s sandbox.

FreeFall: The Ultimate Ball Challenge

Experience the thrill of FreeFall, an addictive iOS ball game that challenges your reflexes and precision! Navigate a fast-moving ball through obstacles using intuitive paddle controls and all under a 60-second time limit.

Earn bonus points for destroying obstacles and advancing difficulty levels, and climb the competitive leaderboard. With realistic physics and secure, cheat-proof scoring, only the best rise to the top.

Objective

Create a runtime manipulation attack that exploits the FreeFall game to achieve impossibly high scores on the leaderboard without legitimate gameplay.

Your goal is to bypass the game's scoring validation mechanisms and submit arbitrary scores that would be impossible to achieve through normal play.

Restrictions: You must perform runtime manipulation to change how the app behaves.

SekureBrowzer: The Privacy-First Mobile Browser

Introducing SekureBrowzer which is the  revolutionary mobile browser built with privacy and security at its core! SekureBrowzer empowers users with instant webpage capture functionality, making it perfect for researchers, students, and professionals who need to document their browsing sessions. Its intelligent deep-linking system allows for seamless integration with other applications, while the built-in screenshot gallery ensures your important captures are always accessible.

Objective

Create a malicious web page that exploits SekureBrowzer's deep-linking and screenshot functionality to silently exfiltrate all stored screenshots from the victim's device to an attacker-controlled server without the victim's knowledge or consent.
Your attack should be able to redirect the user to attacker controlled webpage and should also be able to also trigger the screenshots without additional user interaction. The attacker should be able to steal all the screenshots by means of a html page that the user opens using the SekureBrowzer application.

Restrictions:

  • Your solution must work on non-jailbroken iOS devices.
  • Your exploit must work through standard web browsers where all the victim needs to do is visit a malicious webpage using SekureBrowzer.

After You Upload Your Solution:

01    

Review

We’ll review your submission to confirm correct exploitation. This may take up to 5 business days
02    

Certification

Successfully completing the challenges earns you a verified digital certificate to showcase your skills
03

Recognition

Add your certificate to your LinkedIn profile and portfolio, validating your hands-on skills in iOS application exploitation

Earn a Free Certification and Showcase Your iOS Security Expertise

Outcomes & Takeaways

Each challenge is designed to sharpen your skills and simulate the kinds of problems you’d face in the field. Here's what you’ll walk away with:
 Hands-On Exploitation Skills
Practice reverse engineering, static and dynamic analysis, and bypassing security controls on iOS IPAs that are created to mimick real world vulnerabilities.

 Real-World Scenarios
Work with realistic apps ranging from balance ball games, to productivity-first browsers, that mimic the complexity of production environments.

 Tool Proficiency
Get comfortable using tools like Frida, Ghidra, Medusa, and more in practical settings.

 Security Mindset
Train yourself to think like an attacker: identify weaknesses, understand threat models, and build intuition around mobile app attack strategies and defense evasion.

 Portfolio-Ready Experience
Build a strong foundation that you can showcase, whether you are applying for security roles or contributing to mobile app defense strategies.

Are you ready to test your iOS Security skills?

Turn theory into practice — and see how far you can go.