[levi01]

This will be diffecult with Jailbroken iPhones.

Just because if the default root# & root mobile passwords have been changed by user.
If you have an Jailbroken iDevice in your network with default unchanged password "alpine" you don't even have to do a pentenst.
Search your network for the target iDevice SSH into the device use "alpine" as password and you have root acces to the device.

BTW: most jailbreakers don't even change their password