> For the complete documentation index, see [llms.txt](https://pcastagnaro.gitbook.io/pentest-bug-bounty-resources/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pcastagnaro.gitbook.io/pentest-bug-bounty-resources/pentest-bounty-resources/mobile/ios/sast.md).

# SAST

Reverse Engineering and Static Analysis

## Automated Tools

### Ipanema

Ipanema is a tool for iOS ipa application security assessment.

{% embed url="<https://dev.hackercat.ninja/hcninja/ipanema>" %}

#### Installation

The easiest way is to download a precompiled binary for your architecture and operating system from the releases tab.

If you want to build it by yourself follow this steps:

`go get dev.hackercat.ninja/hcninja/ipanema`\
`go install dev.hackercat.ninja/hcninja/ipanema`

If this doesn't work, go to the project folder and do a `go get -u` before `go install`.

#### Usage

The usage is easy, `ipanema -ipa my.ipa`, the analysis will output some useful info to stdout, and after the analysis finishes you will find all the analysis data in the temporal path created by ipanema under the folder `analysisResult`. This folder will contain multiple txt files with the data specified in the filename, useful to grep for info, aside of this, the whole analysis will be dumped in an `analysis.json` file, try to use `jq` to filter and search through the info.

![Sample usage and output](https://532189072-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Lt8335BPUBXjq3iC572%2F-LterqK01SYlJXmTqAs0%2F-LtevQAOWVFC0T6PPtLi%2Fimage.png?alt=media\&token=ca7c7c21-1e70-465c-a39e-554bcb6459dd)