NSKeyedUnarchiver decodes serialized object graphs from binary data. The legacy decode APIs - unarchiveObjectWithData:, unarchiveObjectWithFile:, initForReadingWithData: - permit any class in the O...
iOS - ASWebAuthenticationSession Without Ephemeral Session
ASWebAuthenticationSession opens a browser view to handle OAuth and single-sign-on flows. When prefersEphemeralWebBrowserSession is false (the default), Safari’s full cookie jar is shared - the sam...
iOS - NSURLCache Sensitive Response Caching
URLSession caches HTTP responses on disk by default. The cache lands at Library/Caches/<bundle-id>/Cache.db - a SQLite file containing full response bodies and headers, including Authorizatio...
iOS - Re-Signing Detection Bypass
For non-jailbroken iOS pentesting, the standard workflow is patching the IPA with FridaGadget.dylib and re-signing with a free developer profile. The app runs on your device, Frida hooks in, you in...
iOS - Endpoint Recovery with class-dump
class-dump (and its forks class-dump-z, classdump-dyld) extracts the Objective-C class metadata from an iOS Mach-O binary. The output is a header-file-style listing of every class, its instance var...
iOS - Debugger Detection Bypass
Apps that try to detect debuggers on iOS use three primary techniques: ptrace(PT_DENY_ATTACH) to refuse attachment, sysctl to check the process’s P_TRACED flag, and getppid() comparisons. Each is b...
iOS - Jailbreak Detection Bypass
iOS jailbreak detection clusters into three vectors. Knowing each one and the matching bypass lets you survive on a JB device through any app that runs JB checks. This post is a working playbook. ...
iOS - Deep Link Parsing
Once an iOS app handles a deep link (custom scheme or Universal Link), the application(_:open:options:) callback receives the URL. What happens next is the bug surface. Apps that route based on the...
iOS - URLSession That Proceeds on Cert Error
URLSession delegate handlers that respond to TLS challenges by calling the completion handler with a “use this credential” disposition without actually verifying the certificate are a subtle but co...
iOS - Unencrypted CoreData and Realm
CoreData (Apple’s persistence framework) and Realm (a popular third-party DB) both store data on disk in the app’s container. By default, neither is encrypted. iOS Data Protection covers the files ...