What is iOS and its Structure¶

Introduction to Jailbreaking and Tools¶

A. What is iOS?

iOS is a mobile operating system created and developed by Apple Inc. exclusively for iPhone, iPod,iPad & Apple TV
Provides multi-tasking (allowing a user to perform more than one computer task)
It only allows running Apple signed applications.

B. What is Jailbreaking?

Jailbreak gives full access to the device.
We Can say it is the privilege escalation from a normal user to root.
Allows installing Apps that are not authorized.
Install Application from Cydia which is AppStore for jailbreak Devices.

Types of jailbreak

Tethered

Users need to reconnect to their computer every time the device is restarted

Untethered

it's a one-time activity. no need to reconnect.

We will see how to jailbreak in an upcoming blog post.

D. iOS Architecture

It contains an intermediate layer between the applications and the hardware so they do not communicate directly.
it contains four layers *
Core OS
Core Services
Media Services
Cocoa Touch

Let us discuss one by one

1. Core OS Layer

A layer with which most applications interact.
All the iOS technologies are built on the low-level features provided by the Core OS layer.
These technologies include Core Bluetooth Framework, External Accessory Framework, Accelerate Framework, Security Services Framework, Local Authorisation Framework, etc.
The developer has limited access to this layer. still, the developer has the privileges to access the following frameworks *
Accelerate - Big number and DSP calculations
External Accessory - Communicate with hardware accessories.
Security - Certificates and Cryptography
System - Low-level Operating system method

Core Services¶

The Core Services layer provides an abstraction over the services provided in the Core OS layer.
It provides fundamental access to iPhone OS services.
Following frameworks available in the cure services layer:
Cloudkit Framework - The data can be moved between the app the iCloud using the Cloudkit Framework.
Core Foundation Framework - This provides data management and service features for iOS apps.
Core Data Framework - The data model of the model view controller app is handled using the Core Data Framework.
Address Book Framework - The address book framework provides access to the contacts database of the user.
Core Motion Framework - All the motion-based data on the device is accessed using the core motion framework.
Healthkit Framework - The health-related information of the user can be handled by this new framework.
Core Location Framework - This framework provides the location and heading information to the various apps.
Core Location- GPS, cellular, or wi-fi based location services

Media Services¶

The Media layer provides multimedia services that you can use within your iPhone.
The media layer enables all the graphics, audio, and video technology of the system.
Allows the developer to work with photos, videos, audios, animations, graphics-like things.
It contains the following frameworks.
AVFoundation: Advanced audio and video
UIKit Graphics: Designing images and animating the view content.
Core Graphics Framework: Support 2-D vector and image-based rendering and is the Native drawing engine for iOS apps.
Core Animation: The Core Animation technology optimizes the animation experience of the apps.
Core Audio: Low-level audio
Media Player: Support audio, video playback & enables the user to use their iTunes library.
Core Text: Advanced text layouts and fonts

Cocoa Touch Layer¶

Cocoa: Touch layer provides an abstraction layer to expose the various libraries for programming the iPhone, and other IOS devices.
As per Apple documentation following frameworks are there:
UIKit- UI element, life cycle management, etc
Message Kit- Responsible for Email, SMS
Address Book- Contact, editing.
Event Kit- Alarm, Calendar events, etc.
Game Kit- Responsible for gaming activity.
iAd- It supports Apple’s advertisement platform
Map Kit- Google map, Apple map.
Message Kit- Responsible for Email etc

Setting Up Frida and Objection

Hello All. In this post I'll show how we can setup Frida, Objection, Fireprint Scanner for firebase DB scan, How to dump IPA file to perform Reverse Engineering and Static Analysis using Opensource Tool Mobsf. Also, look at how we use Frida to decrypt iOS files from the iDevice. So Let's Start.

Tools Needed:

Frida
Frida-dump
iDevice
PC
Fireprint Let's have a short introduction to the following terms before proceeding further.
Frida Frida is a free and open-source dynamic instrumentation toolkit, that allows developers, reverse-engineers, and security researchers to monitor and debug running processes. It also enables programmers, software, and security professionals to execute their own JS scripts into other processes running on
Objection It's a runtime mobile exploration toolkit, powered by Frida, built to help you assess the security posture of your mobile applications, without need.

iOS Application Pentesting Blog By Sunil Kande¶

1. What is iOS \ 2. iOS Architecture \ 3. What is Jailbreak \ 4. How to Jailbreak \ 5. How to set-up a pen-testing Environment\ 6. Local Storage Vulnerabilities a. Plist file b. Nsuserdefault Storage c. Keychain d. Core Data e. Webkit Caching f. SQLite Database \ 7. What is SSL pinning in Mobile \ 8. How to bypass SSL pinning \ 9. What is Hooking in iOS \ 10. Fun with Frida \ 11. Fun with Objection \ 12. SSL pinning bypass with Frida & Objection \ 13. Jailbreak Detection Bypass using Frida \ 14. Runtime manipulation \ 15. Binary Protection \ 16. How to decrypt IPA using Frida Script \ 17. Automation with Objection \ 18. Side Channel Data Leakage a. Device Log b. App Screenshot c. Pastboard d. Keystroke Logging e. Cookies(Binary) \ 19. Broken Cryptography \ 20. Webview issues \ 21. SSL pinning Bypass Challenges \ 22. Network Layer Challenges \ 23. Sensi