Certified Mobile Pentester (CMPen) – iOS

The Certified Mobile Pentester (CMPen) – iOS exam is an intermediate-level exam to test a candidate’s knowledge on the core concepts of an iOS app security. Candidates must be able to demonstrate practical knowledge to perform static and dynamic analysis of iOS applications to pass this exam.

£250.00
What is the Certified Mobile Pentester – iOS (CMPen-iOS) exam?

The Certified Mobile Pentester (CMPen) – iOS exam is an intermediate-level exam to test a candidate’s knowledge on the core concepts of an iOS app security. Candidates must be able to demonstrate practical knowledge to perform static and dynamic analysis of iOS applications to pass this exam.

Who should take this exam?

CMPen – iOS is intended to be taken by pentesters, security architects and any Mobile security enthusiast, who wants to evaluate and advance their knowledge in iOS application security.

What is the format of the exam?

CMPen – iOS is an intense 4 hour long practical exam. It requires candidates to solve a number of challenges, identify and exploit various vulnerabilities, and obtain flags. The exam can be taken online, anytime (on-demand), and from anywhere. Candidates will need to download the iOS IPA build and connect to the exam VPN server to set up for the exam.

What is the pass criteria for the exam?

The pass criteria are as follows:

  • Candidates scoring over 60% marks will be deemed to have successfully passed the exam.
  • Candidates scoring over 75% marks will be deemed to have passed with a merit.
What is the experience needed to take the exam?

This is an intermediate-level exam. Candidates should have prior knowledge and experience of iOS application pentesting and the associatedย  tactics, techniques and procedures. They should be able to demonstrate their practical knowledge on Mobile security topics by completing a series of tasks on identifying and exploiting vulnerabilities that have been created in the exam environment to mimic the real world scenarios.

Note: As this is an intermediate-level exam, a minimum of two years of professional pentesting/bug-bounty experience is recommended.

What will the candidates get?

On completing the exam, each candidate will receive:

  • A certificate with their pass/fail and merit status.
  • The certificate will contain a code/QR link, which can be used by anyone to validate the certificate.
What is the exam retake policy?

Candidates are allowed one free retake within the exam fees.

What are the benefits of this exam?

The exam will allow candidates to demonstrate their skills in iOS application pentesting. This will help them to advance in their career.

How long is the certificate valid for?

The certification does not have an expiration date. However, the passing certificate will mention the details of the exam such as the exam version and the date. As the exam is updated over time, candidates should retake the newer version as per their convenience.

Will you provide any training that can be taken prior to the exams?

Being an independent certifying authority, we (TheSecOps Group) do not provide any training for the exam. Candidates should carefully go over each topic listed in the syllabus and make sure they have adequate understanding, required experience and practical knowledge of these topics.

Company Free/Paid
Kontra Free
DVIA-v2 Free
OWASP - MSTG Paid
OWASP - iGOAT Free
Security Compass Free
HackTheBox Free/Paid
Attack and Defense Lab Free/Paid
Exam Syllabus

The exam will cover the following topics

iOS Security Architecture and Permission Model
Understanding of iOS Application and its Component
iOS Application Pentesting Environment
Static and Dynamic Analysis
Reverse engineering iOS applications using XCode or Hopper Disassembler
Understanding of iOS Application Pentesting Tools, such as Cydia (Cydia external Repo and tweaks), 3utools, Hopper Disassembler etc.
Traffic Analysis with Burp Suite and Wireshark
Frida, Objection and MobSF
Jailbreak Detection & SSL Pinning Bypass
Local Authentication and TouchID Bypass
Excessive/Insecure Logging and its Analysis
Side Channel Data Leakage
Error & Exception Handling
Memory Management Issues
Webview Issues
Hardcoding Issues
Obfuscation in the Code
Misconfiguration of FirebaseDB and Appshot instance
Inspection of Binary Signing
Analysis of .plist Files
Common Security Misconfigurations and iOS Security Best Practices
  • Insecure Permissions
  • Weak Hashing and Cryptography Algorithms
  • Insecure Data Storage
  • Keychain dump
  • Use of Outdated and Vulnerable Technology Components
  • Insecure Coding Practice
Sample Question?
  • Consider a scenario where you receive an alert that indicates that your EC2 instance behind ELB Classic Load Balancer has been compromised. Which of the following options will you choose to limit the lateral movement and allow evidence gathering?
    1. Remove the instance from the load balancer and terminate it.
    2. Remove the instance from the load balancer, and shut down access to the instance by tightening the security group.
    3. Reboot the instance and check for any Amazon CloudWatch alarms.
    4. Stop the instance and make a snapshot of the root EBS volume.
Prerequisites:
Host Operating System:

Windows/Linux/MacOS with minimum 8GB RAM (MacOS Preferred)

Physical Device with Minimum iOS Version Supported:

iOS 14 and onwards (Jailbroken).

Note: Please make sure you have your iOS pentesting environment ready (Jailbroken Physical Device, Burp Suite, or any similar proxy tool along with Frida, objection and other similar pentesting tools) prior to starting the exam. The IPA build will be distributed via TestFlight.

Certified Mobile Pentester - iOS (CMPen-iOS)

Certified Mobile Pentester-iOS