Skip to content
OWASP iGoat - A Learning Tool for iOS App Pentesting and Security by Swaroop Yermalkar
C Shell Objective-C Tcl M4 Makefile Other
Branch: master
Clone or download
Latest commit abd3081 May 8, 2019
Type Name Latest commit message Commit time
Failed to load latest commit information.
.gitignore .DS_Store banished! Apr 7, 2019
LICENSE added version downloaded from… Sep 16, 2016 Added contributor May 9, 2019
iGoat.ipa uploading latest .ipa file Oct 16, 2017

GSOC 2019

Select the OWASP iGoat Version: Swift 4 Objective C

iGoat (Objective C) was presented at: AppSec USA 2017   c0c0n 2017   SEC-T 2017   BruCON 2017   Bugcrowd Levelup 2017

OWASP iGoat - A Learning Tool for iOS App Pentesting and Security Twitter Follow

iGoat is a learning tool for iOS developers (iPhone, iPad, etc.) and mobile app pentesters. It was inspired by the WebGoat project, and has a similar conceptual flow to it.

As such, iGoat is a safe environment where iOS developers can learn about the major security pitfalls they face as well as how to avoid them. It is made up of a series of lessons that each teach a single (but vital) security lesson.

The lessons are laid out in the following steps:

  1. Brief introduction to the problem.
  2. Verify the problem by exploiting it.
  3. Brief description of available remediations to the problem.
  4. Fix the problem by correcting and rebuilding the iGoat program.

Step 4 is optional, but highly recommended for all iOS developers. Assistance is available within iGoat if you don't know how to fix a specific problem.

Documentation: iGoat Guide

Project Details

Page -

Project Lead - Swaroop Yermalkar (@swaroopsy)

Twitter - (@OWASPiGoat)

Lead Developer - Anthony Gonsalves

Vulnerabities Covered (version 3.0):

  • Key Management

    • Hardcoded Encryption Keys
    • Key Storage Server Side
    • Random Key Generation
  • URL Scheme Attack

  • Social Engineering

  • Reverse Engineering

    • String Analysis
  • Data Protection (Rest)

    • Local Data Storage (SQLite)
    • Plist Storage
    • Keychain Usage
    • NSUserDefaults Storage
  • Data Protection (Transit)

    • Server Communication
    • Public Key Pinning
  • Authentication

    • Remote Authentication
  • Side Channel Data Leaks

    • Device Logs
    • Cut-and-Paste
    • Backgrounding
    • Keystroke Logging
  • Tampering

    • Method Swizzling
  • Injection Flaws

    • SQL Injection
    • Cross Site Scripting
  • Broken Cryptography

How to countribute?

  • You can add new exercises
  • Testing iGoat and checking if any issues
  • Suggest us new attacks
  • Writing blogs / article about iGoat
  • Spreading iGoat :)

To contribute to iGoat project, please contact Swaroop ( or @swaroopsy )

Project Contributors -

  • Anthony Gonsalves
  • Junard Lebajan (@junard)
  • Ken van Wyk
  • Arun @he_hacks
  • Jonathan Carter
  • Heefan
  • Tilak Kumar
  • Bernhard Mueller
  • Sagar Popat
  • Chandrakant Nial
  • Valligayatri Rachakonda
  • Suraj Kumar
  • masbog
  • Cheena Kathpal
  • Matt Tesauro
You can’t perform that action at this time.