# Dynamic Testing of iOS application

<mark style="color:orange;">**To begin Dynamic testing first we have to hook the application using Objection.**</mark>

**For hooking techniques just follow these steps:**

* <mark style="color:green;">**Connect your jailbroken iOS device to your laptop.**</mark>
* <mark style="color:green;">**Use the command**</mark><mark style="color:green;">**&#x20;**</mark><mark style="color:green;">**`frida-ps -Uai`**</mark><mark style="color:green;">**to get a list of all apps currently installed on the connected USB device.**</mark>

<figure><img src="https://miro.medium.com/v2/resize:fit:765/1*65tu4g4PSM-NnMGlJaMBnQ.png" alt=""><figcaption></figcaption></figure>

* <mark style="color:green;">**Look for the DVIA application in the list and note its name.**</mark>
* <mark style="color:green;">**Use the command**</mark><mark style="color:green;">**&#x20;**</mark><mark style="color:green;">**`objection -g "DVIA-v2" explore`**</mark><mark style="color:green;">**&#x20;**</mark><mark style="color:green;">**explore to connect to the application.**</mark>
* <mark style="color:green;">**Use the**</mark><mark style="color:green;">**&#x20;**</mark><mark style="color:green;">**`env`**</mark><mark style="color:green;">**&#x20;**</mark><mark style="color:green;">**command to view the environment variables for the application, including its path.**</mark>

<figure><img src="https://miro.medium.com/v2/resize:fit:875/1*wE0YGw-2sblrzYXDmeSMtg.png" alt=""><figcaption></figcaption></figure>

1. <mark style="color:orange;">**Check for Sensitive Information saved by the application in the filesystem.**</mark>

* **Verify the presence of sensitive information in various locations, including plist files, the Firebase database, keychains, device logs, app screenshots, and cookies.**
* **Sensitive Data in Plist file- Locate sensitive data in the plist file using the framework Objection by typing&#x20;**<mark style="color:blue;">**`env`**</mark><mark style="color:blue;">**,**</mark>**&#x20;then navigating to the ‘data directory’, then to the ‘Documents’ folder, and finally using the command&#x20;**<mark style="color:blue;">**`ios plist userInfo.plist`**</mark>**&#x20;as shown below.**

<figure><img src="https://miro.medium.com/v2/resize:fit:805/1*OkMobn3y_m6JJj0ovNHc9w.png" alt="" width="375"><figcaption></figcaption></figure>

<figure><img src="https://miro.medium.com/v2/resize:fit:2385/1*_DPUgPAtcLuQPMfxwdsyvQ.png" alt=""><figcaption></figcaption></figure>

* <mark style="color:green;">**Sensitive Data in UserDefaults- Similarly type**</mark><mark style="color:green;">**&#x20;**</mark><mark style="color:green;">**`ls`**</mark><mark style="color:green;">**&#x20;**</mark><mark style="color:green;">**in**</mark><mark style="color:green;">**&#x20;**</mark><mark style="color:green;">**`Library`**</mark><mark style="color:green;">**&#x20;**</mark><mark style="color:green;">**then**</mark><mark style="color:green;">**&#x20;**</mark><mark style="color:green;">**`cd`**</mark><mark style="color:green;">**into**</mark><mark style="color:green;">**&#x20;**</mark><mark style="color:green;">**`Preferences`**</mark><mark style="color:green;">**then again**</mark><mark style="color:green;">**&#x20;**</mark><mark style="color:green;">**`ls`**</mark><mark style="color:green;">**&#x20;**</mark><mark style="color:green;">**and then use command**</mark><mark style="color:green;">**&#x20;**</mark><mark style="color:green;">**`ios plist can com.highaltitidehacks.DVIAswiftv2.plist`**</mark><mark style="color:green;">**&#x20;**</mark><mark style="color:green;">**as shown below.**</mark>

<figure><img src="https://miro.medium.com/v2/resize:fit:805/1*T5BLC2GzksgsRP7FZxsdMQ.png" alt="" width="375"><figcaption></figcaption></figure>

<figure><img src="https://miro.medium.com/v2/resize:fit:2390/1*Yy1GturkHYQwhznVnXxWlQ.png" alt=""><figcaption></figcaption></figure>

* <mark style="color:green;">**Sensitive Data in Keychain- Once the user is logged in, developer can store his username and password to the keychain to access the application using keychain. We can dump the keychain using**</mark><mark style="color:green;">**&#x20;**</mark><mark style="color:green;">**`ios keychain dump_raw`**</mark><mark style="color:green;">**&#x20;**</mark><mark style="color:green;">**command which gives us the hexadecimal value then we have to decode this using hex to ascii convertor.**</mark>

<figure><img src="https://miro.medium.com/v2/resize:fit:805/1*-17tir8Huk2_ZNpOMMAaQw.png" alt="" width="375"><figcaption></figcaption></figure>

<figure><img src="https://miro.medium.com/v2/resize:fit:2378/1*yJmMQ_OP4_Vei4rS82JiIg.png" alt=""><figcaption></figcaption></figure>

<figure><img src="https://miro.medium.com/v2/resize:fit:1553/1*-6Vp1IMEeSo4U9z5UQpRUw.png" alt=""><figcaption></figcaption></figure>

<figure><img src="https://miro.medium.com/v2/resize:fit:804/1*uXXn11pX8JtqBtkefBvlfQ.png" alt="" width="375"><figcaption></figcaption></figure>

* <mark style="color:green;">**Sensitive Data in Database- Developer can save sensitive data such as username and password in client side database. Locate the Sqlite database at client side and use the command**</mark><mark style="color:green;">**&#x20;**</mark><mark style="color:green;">**`sqlite connect DatabaseName.sqlites`**</mark><mark style="color:green;">**then use**</mark><mark style="color:green;">**&#x20;**</mark><mark style="color:green;">**`.tables`**</mark><mark style="color:green;">**&#x20;**</mark><mark style="color:green;">**to enumerate column names then**</mark><mark style="color:green;">**&#x20;**</mark><mark style="color:green;">**`select * from 'ColumName'`**</mark><mark style="color:green;">**&#x20;**</mark><mark style="color:green;">**to see the data in columns.**</mark>

<figure><img src="https://miro.medium.com/v2/resize:fit:805/1*NvDfv1KnSys_viakHBKCRQ.png" alt="" width="375"><figcaption></figcaption></figure>

<figure><img src="https://miro.medium.com/v2/resize:fit:2405/1*_Uw8V5OkAuarCPlfWql1zw.png" alt=""><figcaption></figcaption></figure>

<figure><img src="https://miro.medium.com/v2/resize:fit:875/1*wDzeLNOkr6cb-0iAbX9M1g.png" alt=""><figcaption></figcaption></figure>

* <mark style="color:green;">**Sensitive Data in Cookies- Sometimes the data can get saved in cookies. We can access it using the command**</mark><mark style="color:green;">**&#x20;**</mark><mark style="color:green;">**`ios cookies get --json .`**</mark>

<figure><img src="https://miro.medium.com/v2/resize:fit:805/1*u3czOZb14wGMbSbbBFtYmQ.png" alt="" width="375"><figcaption></figcaption></figure>

<figure><img src="https://miro.medium.com/v2/resize:fit:1155/1*RUeThJNHwdN7DRX5y9S-RQ.png" alt=""><figcaption></figcaption></figure>

<figure><img src="https://miro.medium.com/v2/resize:fit:805/1*zvk_-RhjQ_wK6AHxmCc5rQ.png" alt="" width="375"><figcaption></figcaption></figure>

* <mark style="color:green;">**Sensitive Data in Device Logs- Make sure to always check logs of any application to do this we use**</mark><mark style="color:green;">**&#x20;**</mark><mark style="color:green;">**`idevice_id`**</mark><mark style="color:green;">**&#x20;**</mark><mark style="color:green;">**command to find the id of the iOS device then use the command**</mark><mark style="color:green;">**&#x20;**</mark><mark style="color:green;">**`idevicesyslog -u idevice_id | grep "application name"`**</mark><mark style="color:green;">**we can also store the logs we just have to use > operator the command will be**</mark><mark style="color:green;">**&#x20;**</mark><mark style="color:green;">**`idevicesyslog -u idevice_id | grep "application name" > logs.txt`**</mark><mark style="color:green;">**&#x20;**</mark><mark style="color:green;">**.**</mark>

<figure><img src="https://miro.medium.com/v2/resize:fit:805/1*rlFkIMRIzbHJ1o82A6O_rw.png" alt="" width="375"><figcaption></figcaption></figure>

<figure><img src="https://miro.medium.com/v2/resize:fit:2405/1*klJhCe_crwhfnyHUvLXK2Q.png" alt=""><figcaption></figcaption></figure>

<mark style="color:orange;">**Unfortunately the DVIA-v2 application was crashing always when i was clicking on the Sign Up button hence we are not able to see the data in the logs.**</mark>

* <mark style="color:green;">**Sensitive Data in App Screenshots- Whenever you press the home button, iOS takes a snapshot of the current screen to be able to do the transition to the application on a much smoother way. However, if sensitive data is present in the current screen, it will be saved in the image (which persists across reboots). These are the snapshots that you can also access double tapping the home screen to switch between apps. Locate the screenshot folder in the application and download the file using command**</mark><mark style="color:green;">**&#x20;**</mark><mark style="color:green;">**`file download filename`**</mark><mark style="color:green;">**&#x20;**</mark><mark style="color:green;">**.**</mark>

<figure><img src="https://miro.medium.com/v2/resize:fit:805/1*tN3ENNJxFuk-T3Oxbz8wLw.png" alt="" width="375"><figcaption></figcaption></figure>

<figure><img src="https://miro.medium.com/v2/resize:fit:1905/1*ce4JOI57Y9l_JwdI2FursA.png" alt=""><figcaption></figcaption></figure>

<figure><img src="https://miro.medium.com/v2/resize:fit:605/1*0BZzDoBo6-G53cBugAOU1Q.jpeg" alt=""><figcaption></figcaption></figure>

<mark style="color:orange;">**2. Broken Cryptography**</mark>

* **S**<mark style="color:green;">**aving sensitive data in local storage and encrypting it with a hardcoded or predictable key in the code is not a secure practice. This can be easily reversed by attackers, allowing them access to the confidential information. Additionally, developers should avoid using deprecated algorithms for authorization checks, data storage, or data transmission. These include algorithms such as RC4, MD4, MD5, and SHA1, which are no longer considered secure and may leave data vulnerable to attack. It’s important to use current, secure algorithms and best practices to protect sensitive data.**</mark>
* <mark style="color:green;">**The main check is to moniter the crypt libraries using objection so that we can find which algorithm was used to encrypt the data. We can use Objection command**</mark> <mark style="color:blue;">**`ios monitor crypt`**</mark><mark style="color:blue;">**&#x20;**</mark><mark style="color:blue;">**.**</mark>

<figure><img src="https://miro.medium.com/v2/resize:fit:875/1*1goSGNFyBawksP_zjKoIQg.png" alt=""><figcaption></figcaption></figure>

<figure><img src="https://miro.medium.com/v2/resize:fit:875/1*D5BWARzOlFYUTeTWdcEkRg.png" alt=""><figcaption></figcaption></figure>

<mark style="color:orange;">**3. Local Authentication using Keychain**</mark>

* <mark style="color:green;">**The iOS keychain APIs can be used to implement local authentication. During this process, the app stores either a secret authentication token or another piece of secret data identifying the user in the keychain. In order to authenticate to a remote service, the user must unlock the keychain using their passphrase or fingerprint to obtain the secret data.**</mark>
* <mark style="color:green;">**Sometimes we can easily bypass the local authentication check using objection command**</mark>**&#x20;**<mark style="color:blue;">**`ios ui biometrics_bypass`**</mark><mark style="color:blue;">**&#x20;**</mark><mark style="color:blue;">**.**</mark>

<figure><img src="https://miro.medium.com/v2/resize:fit:741/1*Bme_FOK06gVlQxMOxk5VXA.png" alt=""><figcaption></figcaption></figure>

<figure><img src="https://miro.medium.com/v2/resize:fit:875/1*xtjo04wOOdD_r8J4ej-tjA.png" alt=""><figcaption></figcaption></figure>

<figure><img src="https://miro.medium.com/v2/resize:fit:741/1*SZWNaCQqf75ezIg4K-UoHw.png" alt=""><figcaption></figcaption></figure>

<mark style="color:orange;">**4. Jailbreak Detection Bypass- We are going to bypass the jailbreak detection using 3 methods.**</mark>

* <mark style="color:green;">**Using Tweaks- For this we are going to use the HideJB tweak. Open the Settings app on your iOS device > Locate the HideJB preferences > Tap on “Select Apps” > Toggle on the button next to the app name that you want to hide the jailbreak status for, as shown in the screenshot.Make sure you close the running app after starting the HideJB to bypass the detection.**</mark>

<figure><img src="https://miro.medium.com/v2/resize:fit:805/1*xsDFskijeQlML7UGe5Askg.png" alt="" width="375"><figcaption></figcaption></figure>

<figure><img src="https://miro.medium.com/v2/resize:fit:805/1*x_TwbrtvQJko9sjGz4TTDQ.png" alt="" width="375"><figcaption></figcaption></figure>

<figure><img src="https://miro.medium.com/v2/resize:fit:805/1*QlW5ApEMjpaCDN9oPXuOYQ.png" alt="" width="375"><figcaption></figcaption></figure>

<figure><img src="https://miro.medium.com/v2/resize:fit:805/1*DED_ZT8htgy4WtpH4bnXXQ.png" alt="" width="375"><figcaption></figcaption></figure>

<figure><img src="https://miro.medium.com/v2/resize:fit:805/1*zXShr8uuZK73h6jEBmLX9g.png" alt="" width="375"><figcaption></figcaption></figure>

<figure><img src="https://miro.medium.com/v2/resize:fit:805/1*SWw9MC5zTWVoFReC2TSTbg.png" alt="" width="375"><figcaption></figcaption></figure>

* <mark style="color:green;">**Using Objection- Run the**</mark> <mark style="color:blue;">**`ios jailbreak disable`**</mark>**&#x20;**<mark style="color:green;">**command in the Objection console > Try to access the application you wish to bypass the jailbreak detection for > If successful, the jailbreak detection will be bypassed and you will be able to access the app**</mark>

<figure><img src="https://miro.medium.com/v2/resize:fit:2405/1*RymB0-m-qqKrkiNROPmkdg.png" alt=""><figcaption></figcaption></figure>

<figure><img src="https://miro.medium.com/v2/resize:fit:805/1*oKSO1gBSEh7S1DHj8DaSmw.png" alt="" width="375"><figcaption></figcaption></figure>

* <mark style="color:orange;">**Understanding the application jailbreak detection logic -**</mark>

**To understand the application’s logic of jailbreak detection:**

1. <mark style="color:green;">**Use the command**</mark><mark style="color:green;">**&#x20;**</mark><mark style="color:green;">**`ios hooking search jail`**</mark><mark style="color:green;">**&#x20;**</mark><mark style="color:green;">**to find the jailbreak detection classes.**</mark>
2. <mark style="color:green;">**Use the command**</mark><mark style="color:green;">**&#x20;**</mark><mark style="color:green;">**`ios hooking list class_methods ClassName`**</mark><mark style="color:green;">**&#x20;**</mark><mark style="color:green;">**to list the methods within the classes here our classname is “JailbreakDetection”**</mark>
3. <mark style="color:green;">**Use the command**</mark><mark style="color:green;">**&#x20;**</mark><mark style="color:green;">**`ios hooking watch method "+[ClassName MethodName]" --dump-args --dump-backtrace --dump-return`**</mark><mark style="color:green;">**&#x20;**</mark><mark style="color:green;">**to observe the method. Only**</mark><mark style="color:green;">**&#x20;**</mark><mark style="color:green;">**`--dump-return`**</mark><mark style="color:green;">**&#x20;**</mark><mark style="color:green;">**will suffice to determine the value it returns. Here our classname is “JailbreakDetection” and method name is “isJailbroken”**</mark>\ <mark style="color:green;">**If the method returns 0x1, it means it is returning a boolean value of 1, indicating that the device is jailbroken.**</mark>
4. <mark style="color:green;">**Now we have to create custom script to bypass this logic , use the command**</mark><mark style="color:green;">**&#x20;**</mark><mark style="color:green;">**`ios hooking generate simple ClassName`**</mark><mark style="color:green;">**to write a custom script that will change the return value of this method.**</mark>
5. <mark style="color:green;">**Copy the generated script from the previous step. Open a text editor and paste the script. Modify the variable value from ‘var’ to ‘const’ then**</mark>\ <mark style="color:green;">**within the ‘onLeave’ function, enter ‘retval.replace(0)’ to return the value of 0. Save the script with the ‘JBbypass.js’ extension and our script should look like this in the 4th screenshot.**</mark>
6. <mark style="color:green;">**Use the Frida command**</mark><mark style="color:green;">**&#x20;**</mark><mark style="color:green;">**`frida -l JBbypass.js -n "DVIA-v2" -U`**</mark><mark style="color:green;">**to execute the script and bypass the jailbreak detection.**</mark>

<figure><img src="https://miro.medium.com/v2/resize:fit:805/1*CDu_iGb9_ANj6Mb3uwBoaw.png" alt="" width="375"><figcaption></figcaption></figure>

<figure><img src="https://miro.medium.com/v2/resize:fit:2195/1*lEX0RBe8xto7M-9e8q0FDQ.png" alt=""><figcaption></figcaption></figure>

<figure><img src="https://miro.medium.com/v2/resize:fit:1395/1*hsDE7mFru6jitLujVs7uCQ.png" alt=""><figcaption></figcaption></figure>

<figure><img src="https://miro.medium.com/v2/resize:fit:1235/1*6fSR36CToPMZJwzLMt9I6Q.png" alt=""><figcaption></figcaption></figure>

<figure><img src="https://miro.medium.com/v2/resize:fit:1130/1*_EL1fx_dCGXhHUTuXO5HHQ.png" alt=""><figcaption></figcaption></figure>

<figure><img src="https://miro.medium.com/v2/resize:fit:805/1*ke4khIPdW4VWpvuPJmWe4w.png" alt="" width="375"><figcaption></figcaption></figure>

* <mark style="color:green;">**In the same way, we can bypass jailbreak detection in another class named “DVIA\_v2.JailbreakDetectionViewController”, which contains 5 methods that return different values. However, this class is implemented in Swift, so we cannot hook it directly using Objection or Frida. The logic of jailbreak detection in iOS is similar to root detection in Android. In iOS, jailbreak detection checks for the presence of specific binary files on the device. If these files are present, it indicates that the device is jailbroken. We can find online script for this and can bypass using frida.**</mark>

<figure><img src="https://miro.medium.com/v2/resize:fit:2021/1*fQjQga--pcS8ZKHOhhTWpA.png" alt=""><figcaption></figcaption></figure>

<figure><img src="https://miro.medium.com/v2/resize:fit:1671/1*FpA3II2eU-i75BJNWBR1Tw.png" alt=""><figcaption></figcaption></figure>

<figure><img src="https://miro.medium.com/v2/resize:fit:2019/1*2BE2fnwxp3uC9KKHdZI4aQ.png" alt=""><figcaption></figcaption></figure>

<figure><img src="https://miro.medium.com/v2/resize:fit:805/1*oKSO1gBSEh7S1DHj8DaSmw.png" alt="" width="375"><figcaption></figcaption></figure>

**5.&#x20;**<mark style="color:orange;">**SSL Pinning Bypass- We are going to bypass SSL Pinning using 2 methods. Make sure proxy is enabled and running as shown in the envirnoment setup step.**</mark>

* <mark style="color:green;">**Using Tweaks- For this we are going to use the SSL Kill Swtich 2 tweak. Open the Settings app on your device. > Locate the SSL Kill Switch 2 preferences. > Toggle on the button next to ‘Disable Certificate Validation’ > Use the Burp Suite to capture the request. Make sure you close the running app after starting the SSL Kill Swtich 2 to bypass the SSL Pinning.**</mark>

<figure><img src="https://miro.medium.com/v2/resize:fit:875/1*RLsHCeex_S5BWqA1yFksXA.png" alt=""><figcaption></figcaption></figure>

<figure><img src="https://miro.medium.com/v2/resize:fit:805/1*nmvS4aJzsT-_cfSdK2g9DQ.png" alt="" width="375"><figcaption></figcaption></figure>

<figure><img src="https://miro.medium.com/v2/resize:fit:1255/1*Bf88jNDyc4GyWvm0r4JeMg.png" alt=""><figcaption></figcaption></figure>

* <mark style="color:green;">**Using Objection- Simply use the objection command**</mark><mark style="color:green;">**&#x20;**</mark><mark style="color:green;">**`ios sslpinning disable`**</mark><mark style="color:green;">**&#x20;**</mark><mark style="color:green;">**and you will be able to capture the application traffic.**</mark>

<figure><img src="https://miro.medium.com/v2/resize:fit:875/1*Meaxkpt097BERSwALHPXZQ.png" alt=""><figcaption></figcaption></figure>

<figure><img src="https://miro.medium.com/v2/resize:fit:805/1*ONrn2CrmoRl4DNnfjm449A.png" alt="" width="375"><figcaption></figcaption></figure>

<figure><img src="https://miro.medium.com/v2/resize:fit:1101/1*dVXoGny0mt8C1qZ4fWrWqg.png" alt=""><figcaption></figcaption></figure>

<mark style="color:orange;">**Tools List:**</mark>

1. <mark style="background-color:purple;">**Linux — libmobiledevice, Frida, Objection, MOBSF, SSH,Burp Suite,Checkra1n.**</mark>
2. <mark style="background-color:purple;">**iOS — Cydia Manager, Hide JB, Frida, Appsync Unified, Otool,SSL Kill Switch 2, OpenSSH**</mark>

<br>
