simplectf

IOS FRIDA OBJECTION PENTESTING

15 June 2023







INSTALL FRIDA OBJECTION

To install Frida and its associated tools, you can follow these step-by-step instructions:


Install Python:

Frida requires Python to be installed on your system. You can download and install Python from the official Python website https://www.python.org Make sure to choose the appropriate version for your operating system.


Install Frida and Objection:
$ pip3 install frida-tools
$ pip3 install objection

Step Setting For IOS:

Start Cydia and add Frida repository by going to Manage -> Sources -> Edit -> Add and enter https://build.frida.re. You should now be able to find and install the Frida package which lets Frida inject JavaScript into apps running on your iOS device. This happens over USB, so you will need to have your USB cable handy, though there no need to plug it in just yet.


List all running processes:
$ frida-ps -U
$ frida-ps -Ua

List all installed applications:
$ frida-ps -Uai

Use OBJECTION for IOS
$ objection -g 12345 explore

You can use PID or Bundle ID to lauch app and attach it.

$ objection -g com.apple.tv explore

IOS info binary:
# ios info binary
a


App bundle info:

Use ios bundles to list app frameworks and bundles.

# ios bundles list_frameworks
a
# ios bundles list_bundles
a


List app directories:
# env
a


List files in app directory:

You can use ls command to list files in app directory, and you can use cd command to check working directory

# ls
a


View file content:

You can use file cat command to view file content.

# file cat Info.plist
a

You can use for plist type file, can also use ios plist cat "plist file path" to decode plist file.

# ios plist cat Info.plist
a


Download file from device:

You can use file download "file path" to download a file from device.

# file download Info.plist
a


See the Cookies:

You can use ios cookies get to get cookies.

# ios cookies get
a


Dump all of the credentials:

You can use ios nsurlcredentialstorage dump to dump all of the credentials in the shared NSURLCredentialStorage.

# ios nsurlcredentialstorage dump
a


List all loaded frameworks/modules:

You can use memory list modules to list all the loaded modules in the current process.

# memory list modules
a


Dump app memory:

You can use memory dump all "output file path" to dump app memory to.

# memory dump all memory.dump
a

After dump memory, you can use strings to check readable strings in memory,

# strings memory.dump | grep -i username
# strings memory.dump | grep -i token


Dump/add/clear iOS keychain:

You can use memory dump all "output file path" to dump app memory to.

add : Add an entry to the iOS keychain
dump : Dump the keychain for the current app's entitlement group
clear : Delete all keychain entries for the current app's entitlement group

Using ios keychain.

# ios keychain dump
a


Monitor Pasteboard:

You can use ios pasteboard monitor to monitor the iOS pasteboard.

# ios pasteboard monitor


Disable sslpinning:

Objection is our best recommendation and first approach to remove certificate pinning on iOS.

# ios sslpinning disable --quiet
a