deardaniel/secdata-raw huggingface dataset:
Objection mobile runtime exploration: ios.cookies.get

Command: ios cookies get

Usage: ios cookies get

Queries iOS's NSHTTPCookieStorage class, extracting cookie values out of the
sharedHTTPCookieStorage. Various URL fetching methods use the
sharedHTTPCookieStorage to store cookie data. This information may be useful
to get session cookies for web services to reuse in other tools/browsers.

Examples:
   ios cookies get
Objection mobile runtime exploration: android.keystore.clear

Command: android keystore clear

Usage: android keystore clear

Clears all aliases in the current applications 'AndroidKeyStore' Keystore. The
KeyStore is loaded, and each alias entry found gets the deleteEntry() method
on the KeyStore called.

Examples:
   android keystore clear
Objection mobile runtime exploration: ios.hooking

Contains subcommands helpful when developing custom hooks. This includes discovery
of Objective-C classes and methods in those classes, as well as dumping method
arguments as they are called in real time.
Objection mobile runtime exploration: commands.clear

Command: commands clear

Usage: commands clear

Clears the current session's command history. After this command, no previous
commands will be available in the history.

Examples:
   commands clear
Objection mobile runtime exploration: ios.keychain.dump raw

Command: ios keychain dump_raw

Usage: ios keychain dump_raw

Dumps raw, unprocessed keychain entries for the current app's entitlement group.
This is an advanced command that shows the keychain data without processing
or formatting.

Examples:
   ios keychain dump_raw
Objection mobile runtime exploration: android.keystore.watch

Command: android keystore watch

Usage: android keystore watch

Watches usage of the Android Keystore. Two KeyStore methods are watched at the
moment. Those are:

KeyStore.getKey()
KeyStore.load()

In both cases, a password for the keystore/key is passed along as the
second parameter of the function.

Ref: https://developer.android.com/reference/java/security/KeyStore.html

Examples:
   android keystore watch
Objection mobile runtime exploration: android.clipboard.monitor

Command: android clipboard monitor

Usage: android clipboard monitor

Gets a handle on the Android clipboard service and polls it every 5 seconds
for data. If new data is found, different from the previous poll, that data
will be dumped to screen.

Examples:
   android clipboard monitor
Objection mobile runtime exploration: import

Command: import

Usage: import <path to local fridascript> (optional: <job name>) (optional: --no-exception-handler)

Imports Fridascript from a file on the local filesystem and executes it as a job.
To 'unload' the script, the job that was started to should be killed.
You can list all of the current jobs using the `jobs list` command. If no name was
specified for your job, a generic name of 'user-script' will be used for the 
job started as a result of the import.

Scripts that are run using this command get wrapped in a global, generic JavaScript try/catch
block. If this is not something that you want, the '--no-exception-handler' flag may be specified.

Examples:
   import ~/home/myscript.js
   import ~/home/hooks/custom.js custom-hook-name
   import ~/home/hooks/custom.js custom-hook-name --no-exception-handler
   import ~/home/script.js --no-exception-handler
Objection mobile runtime exploration: ios.hooking.generate

Command: ios hooking generate

Usage: ios hooking generate <subcommand>

Contains subcommands to generate Frida hooks for iOS Objective-C classes.

Examples:
   ios hooking generate class <class name>
   ios hooking generate simple <class name>
Objection mobile runtime exploration: ios.plist.cat

Command: ios plist cat

Usage: ios plist cat <remote plist filename>

Parses and echoes a plist file on the remote iOS device to screen. If this
parsing is not sufficient, one can always `download` the plist file itself
for parsing using other tools.

Examples:
   ios plist cat Info.plist
Objection mobile runtime exploration: ios.heap.search

Command: ios heap search

Usage: ios heap search <subcommand>

Contains subcommands to search for information about the iOS heap.

Examples:
   ios heap search instances <class name>
Objection mobile runtime exploration: ios.bundles.list bundles

Command: ios bundles list_bundles

Usage: ios bundles list_bundles (optional: --full-path)

Returns all the application's non-framework bundles. [1]

Output includes the frameworks executable, bundle name and version. The path
value is truncated by default, however, adding the --full-path flag would
print the entire path to the framework.

[1] https://developer.apple.com/documentation/foundation/nsbundle/1413705-allbundles?language=objc

Examples:
   ios bundles list_bundles
   ios bundles list_bundles --full-path
Objection mobile runtime exploration: !

Command: !

Usage: ! <shell command>

Executes operating system commands using pythons Subprocess module.
Commands that have caused an error, or when there is output to
display from stderr, will show in red. Commands that have output
that was sent to stdout will display in white.

Examples:
   !ls
   !uname -a
Objection mobile runtime exploration: ios.heap.execute

Command: ios heap execute

Usage: ios heap execute <object address> <method name> [--return-string]

Executes a method on an Objective-C object on the heap. This allows dynamic
invocation of object methods for testing and exploration.

Flags:
   --return-string   Convert the return value to a string

Examples:
   ios heap execute 0x12345678 "description"
   ios heap execute 0x12345678 "description" --return-string
Objection mobile runtime exploration: android.heap.evaluate

Command: android heap evaluate

Usage: android heap evaluate <object handle> <javascript>

Evaluates JavaScript on a Java object handle. This allows complex operations
and transformations using Frida's JavaScript runtime.

Examples:
   android heap evaluate 0x12345678 "this.myMethod()"
   android heap evaluate 0x12345678 "this.toString()"
Objection mobile runtime exploration: evaluate

Command: evaluate

Usage: evaluate <javascript>

Evaluates JavaScript within the agent context. This allows direct execution of
Frida scripts for advanced manipulation and testing.

Examples:
   evaluate "send({msg: 'hello'})"
   evaluate "console.log(Java.enumerateLoadedClasses())"
Objection mobile runtime exploration: android.intent.launch service

Command: android intent launch_service

Usage: android intent launch_service <service class>

Launches an exported service class by building a new Intent and running startActivity()
with it as an argument. The Intent.FLAG_ACTIVITY_NEW_TASK flag is added to achieve
this, with the side effect that the history stack may be reset.

Examples:
   android intent launch_service com.test.example.PingService
   android intent launch_service com.test.example.utils.SyncService
Objection mobile runtime exploration: android.heap.search.instances

Command: android heap search instances

Usage: android heap search instances <class>

Search for and print live instances of a specific Java class, specified by
a fully qualified class name. Output is the result of an attempt at getting
a string value for a discovered object which would typically contain
property values for the object. Hashcodes in the list could be used for
other heap interactions.

Examples:
   android heap search instances java.net.Socket
   android heap search instances java.io.File
Objection mobile runtime exploration: ios.hooking.watch

Command: ios hooking watch

Usage: ios hooking watch <pattern> 
       [--dump-args] [--dump-backtrace] [--dump-return] [--include-parents]

Hooks into Objective-C methods matching the specified pattern and reports on 
invocations.

Flags:
   --dump-args         Dump method arguments when invoked
   --dump-backtrace    Dump the call stack backtrace
   --dump-return       Dump method return values
   --include-parents   Include methods inherited from parent classes

Examples:
   ios hooking watch KeychainDataManager
   ios hooking watch "+[KeychainDataManager update:forKey:]"
   ios hooking watch PinnedNSURLSessionStarwarsApi --include-parents
   ios hooking watch KeychainDataManager --dump-args --dump-return
Objection mobile runtime exploration: android.sslpinning.disable

Command: android sslpinning disable

Usage: android sslpinning disable

Attempts to disable SSL Pinning on Android devices. This is achieved by creating
a new TrustManager that will accept any certificate irrespective of its validity,
and providing that to calls to SSLContext.init(). Additionally, to support the
OkHTTP v3 library, the okhttp3.CertificatePinner.check() method is replaced with
one that will not throw an exception in the case of an invalid certificate being
presented.

With these two implementations, the following request libraries should have its
pinning checks disabled with this command:

- Traditional HttpsURLConnection
- OkHTTP
- Retrofit (Wraps OkHTTP)
- Volley (Uses a TrustManager)
- Picasso (Uses a TrustManager)

If this method does not disable the applications SSL pinning implementation,
then it may still be possible to bypass it via 'helper' methods commonly
used by developers to help when testing in development / staging environments.
Be on the lookout for classes / methods that relate to pinning that may simply
return a boolean value.

Examples:
   android sslpinning disable
Objection mobile runtime exploration: sqlite.execute.schema

Command: sqlite execute schema

Usage: sqlite execute schema

Get the database schema for the currently connected SQLite database.

Examples:
   sqlite execute schema
Objection mobile runtime exploration: ios.keychain.clear

Command: ios keychain clear

Usage: ios keychain clear

Clears all the keychain items for the current application. This is achieved by
iterating over the keychain type classes available in iOS and populating a search
dictionary with them. This dictionary is then used as a query to SecItemDelete(),
deleting the entries.
Items that will be deleted include everything stored with the entitlement group used
during the patching/signing process.

Examples:
   ios keychain clear
Objection mobile runtime exploration: ios.hooking.set.return value

Command: ios hooking set return_value

Usage: ios hooking set return_value "<full class & selector>" <true/false>

Hooks into a specified Objective-C method and sets its return value to
either True or False. This is useful in cases where simple methods are used
to determine things like 'Should SSL pinning be enabled?' as an example.

Examples:
   ios hooking set return_value "+[JailbreakDetection isJailbroken]" false
   ios hooking set return_value "-[SecurityHelper shouldPinSSL:]" true
Objection mobile runtime exploration: env

Command: env

Usage: env

Display directory information for the current application environment.

On iOS devices, this includes the location of the applications bundle,
the Documents/ and Library/ directory.

On Android devices, this includes the location of the files and cache
directories to name a few.

Examples:
   env
Objection mobile runtime exploration: android.hooking.watch

Command: android hooking watch

Usage: android hooking watch <class/method pattern> 
       [--dump-args] [--dump-backtrace] [--dump-return]

Hooks Android Java methods matching the specified pattern and reports on 
invocations. The pattern can be a class name, a package pattern with 
wildcards, or a specific class and method separated by an exclamation 
mark (!).

Flags:
   --dump-args       Dump method arguments when invoked
   --dump-backtrace  Dump the call stack backtrace
   --dump-return     Dump method return values

Examples:
   android hooking watch com.example.test
   android hooking watch *com.example*!*
   android hooking watch com.example.test.MyClass!login
   android hooking watch com.example.test --dump-args --dump-return
Objection mobile runtime exploration: ios.hooking.generate.simple

Command: ios hooking generate simple

Usage: ios hooking generate simple <class name>

Generates simple Frida hooks for each method in the specified iOS Objective-C class.
This creates basic hooks that log method invocations without complex processing.

Examples:
   ios hooking generate simple NSString
   ios hooking generate simple UIViewController
Objection mobile runtime exploration: ios.sslpinning.disable

Command: ios sslpinning disable

Usage: ios sslpinning disable

Attempts to disable SSL Pinning on iOS devices. This is achieved by hooking
into methods commonly used by Frameworks and Libraries such as AFNetworking,
NSURLSession and the now deprecated NSURLConnection.
This command also implements the bypass techniques used in the well-known
SSL-Killswitch2 app, including a new technique reportedly working in iOS10.

If this method does not disable the applications SSL pinning implementation,
then it may still be possible to bypass it via 'helper' methods commonly
used by developers to help when testing in development / staging environments.
Be on the lookout for classes / methods that relate to pinning that may simply
return a BOOL value.

Examples:
   ios sslpinning disable
Objection mobile runtime exploration: android.keystore.detail

Command: android keystore detail

Usage: android keystore detail

Lists detailed 'AndroidKeyStore' items for the current application.

Ref: https://developer.android.com/reference/java/security/KeyStore.html

Examples:
   android keystore listDetails
Objection mobile runtime exploration: ios.monitor.crypto

Command: ios monitor crypto monitor

Usage: ios monitor crypto monitor

Hooks CommonCrypto to output information about cryptographic operation. Works best for AES with PKCS7 Padding.
Currently the following hooks are supported: 
 - SecRandomCopyBytes
 - CCKeyDerivationPBKDF
 - CCCrypt
 - CCCryptorCreate
 - CCCryptorUpdate
 - CCCryptorFinal

Examples:
   ios monitor crypto monitor
Objection mobile runtime exploration: sqlite.sync

Command: sqlite sync

Usage: sqlite sync

Sync the locally cached SQLite database with the remote database.
Any changes made since the last `sqlite connect` will be available on the
device post-sync.

Examples:
   sqlite sync
Objection mobile runtime exploration: ios.heap.print

Command: ios heap print

Usage: ios heap print <subcommand>

Contains subcommands to print information about objects on the iOS heap.

Examples:
   ios heap print ivars <object>
   ios heap print methods <object>
Objection mobile runtime exploration: filesystem

Command: filesystem

Usage: filesystem <subcommand>

Contains subcommands to work with files on the remote filesystem. Previously called `file`

Examples:
   filesystem cat <file>
   filesystem upload <local file> <remote path>
   filesystem download <remote file or folder> [--folder]
Objection mobile runtime exploration: android.hooking.list.receivers

Command: android hooking list receivers

Usage: android hooking list receivers

List all the Broadcast Receivers that have been registered at Runtime
as well as those specified by the AndroidManifest.xml.

Examples:
   android hooking list receivers
Objection mobile runtime exploration: android.hooking.list.class loaders

Command: android hooking list class_loaders

Usage: android hooking list class_loaders

Lists the registered class loaders in the Android application.
This is useful for understanding the class loading hierarchy.

Examples:
   android hooking list class_loaders
Objection mobile runtime exploration: ping

Command: ping

Usage: ping

Pings the injected Frida agent to verify connectivity. If the agent responds
successfully, the connection is working properly.

Examples:
   ping
Objection mobile runtime exploration: android.hooking.generate.class

Command: android hooking generate class

Usage: android hooking generate class <class name>

Generates a generic Frida hook manager for the specified Android Java class.
This creates a template hook that can be customized for various hooking operations.

Examples:
   android hooking generate class com.example.MyClass
   android hooking generate class android.app.Activity
Objection mobile runtime exploration: ios.ui.dump

Command: ios ui dump

Usage: ios ui dump

Dumps the current, serialized user interface. This is useful to see which values
or classes may be attached to UI elements.

Examples:
   ios dump
Objection mobile runtime exploration: ios.keychain.update

Command: ios keychain update

Usage: ios keychain update --account <account> --service <service> --newData <data>

Updates an entry in the iOS keychain with new data. All parameters are required.

Flags:
   --account   The account name (required)
   --service   The service name (required)
   --newData   The new data to store (required)

Examples:
   ios keychain update --account user@example.com --service com.example.app --newData "newsecret"
Objection mobile runtime exploration: ios.pasteboard.monitor

Command: ios pasteboard monitor

Usage: ios pasteboard monitor

Hooks into the iOS UIPasteboard class and polls the generalPasteboard every
5 seconds for data. If new data is found, different from the previous poll,
that data will be dumped to screen.

Examples:
   ios pasteboard monitor
Objection mobile runtime exploration: ios.nsurlcredentialstorage.dump

Command: ios nsurlcredentialstorage dump

Usage: ios nsurlcredentialstorage dump

Dumps all of the credentials in the shared NSURLCredentialStorage. This includes
credentials stored by URLSession and other networking components.

Examples:
   ios nsurlcredentialstorage dump
Objection mobile runtime exploration: README

# objection agent

This directory contains the source code for the agent used within `objection`. These sources are compiled and shipped with a distribution of `objection`, and live in `/objection/agent.js` in its compiled state.

For more information, such as development environment setup instructions, please refer to the project wiki [here](https://github.com/sensepost/objection/wiki/Agent-Development-Environment).
Objection mobile runtime exploration: README

# plugins

`objection` has the ability to sideload external plugins. This directory contains a few sample plugins that you could use to kickstart developing your own!
Objection mobile runtime exploration: README

# objection stetho plugin

This plugin should sideload Facebook's Stetho [1], loaded as a plugin in objection.

[1] [http://facebook.github.io/stetho/](http://facebook.github.io/stetho/)
Objection mobile runtime exploration: README

# objection Flex plugin

This plugin should sideload Flex[1], loaded as a plugin in objection.
Flex itself should be a shared library (with your target's architecture as either a thin/fat Mach-o).

The source code for a shared library called libFlex is included in this gist as .h and .m files. You need to copy the `Classes/` directory from the official Flex project[1] into your project and compile that as a shared library.

[1] [https://github.com/Flipboard/FLEX](https://github.com/Flipboard/FLEX)
Objection mobile runtime exploration: README

# objection Mettle plugin

This plugin should sideload [Mettle](https://github.com/rapid7/mettle), loaded as a plugin in objection.
Mettle itself should be a shared library available in this directory.

## installation

Getting Mettle is super simple.

1. Clone the respistory with `git clone https://github.com/rapid7/mettle.git`.
2. Build Mettle for your target architecture. Eg: `make TARGET=aarch64-iphone-darwin`.
3. Codesign the new dylib in the build directory with `codesign -f -s <hash> mettle.dylib`
4. Copy the codesigned dylib into this plugin folder.

Running `plugin mettle load` will grab the new dylib and upload it to the device.
Android security resource list: contributing

# Contribution Guidelines

Please ensure your pull request adheres to the following guidelines:

- Search previous suggestions before making a new one, as yours may be a duplicate.
- Make sure your entries is useful before submitting.
- Make an individual pull request for each suggestion.
- Titles should be [capitalized](http://grammar.yourdictionary.com/capitalization/rules-for-capitalization-in-titles.html).
- Link additions should be added to the bottom of the relevant category.
- New categories or improvements to the existing categorization are welcome.
- Check your spelling and grammar.
- Make sure your text editor is set to remove trailing whitespace.
- The pull request and commit should have a useful title.

Thank you for your suggestions!
Reverse engineering iOS apps: Introduction

### Introduction

My interest in application security started when the company I was working for had a contract to build a new app with exclusive features protected behind a login screen and someone downloaded this app from the App Store, reverse engineered it and published a list of its features, including screenshots and text that our entire engineering team thought were protected by the login screen. I had to know _how_ they did that.

At this point in my career I had been working on iOS development for over 6 years, this helped me enter the application security field with an fairly robust understanding of the inner-workings of iOS apps, it was _"just"_ a matter of learning how to protect my applications. But to learn how to protect them, I had to learn how to break them first!

This course is my way of sharing with the community everything I've learned in the past few years of me doing this research full-time. It's intended to help new security enthusiasts explore the exciting world of reversing iOS apps and hopefully help iOS developers create better and more secure applications.

#### What WON'T be covered in this course

- How to jailbreak your device.
- iOS (the operating system) exploitation.
- Tweak development for jailbroken devices.
- Mobile backend API hacking.
- In-depth understanding of ARM assembly.

Just wanted to set the right expectations, this course is basically for everyone that's new to iOS application security and ARM binary reversing.

If you're still interested, join me in learning how to reverse iOS applications!

_Note: Don't worry if you don't have a jailbroken device, you'll only need it for [Module 2](Module-2/README.md). You can skip this module an come back to it once you get your hands on a jailbroken device._
Reverse engineering iOS apps: Final Thoughts

### Final Thoughts

Thank you so much for following along and finishing my course. As you can see, this is one of the topics that I literally love and feel very passionate about. This is why I've spent a lot of time doing research and trying to learn new things, about new tools and most of all new vulnerabilities.

I really hope you enjoyed and learned even just a little about reversing iOS applications. Even if all you learned was how to properly pronounce `Cycript`, I'd still be very happy.

On a more serious note, I honestly hope this course inspired you to start your own research, to get involved with the community and teach us something new and exciting that we don't know about! And if you find vulnerabilities, please do the responsible thing and report them to the author(s). Remember there are companies with public bug bounty programs on [HackerOne](https://www.hackerone.com/), [Bugcrowd](https://www.bugcrowd.com/) and [Synack](https://www.synack.com/) if you're doing a good job and show potential they add you to private programs. 😉

Please, please let me know if there are mistakes, typos or if any of the information throughout the course is inaccurate 🙏🏼 remember that English is my second language, if there are sentences that can be improved also let me know.

Since this is an open source course, there might be people that use it to provide a course on their own or take ideas from here to their own courses. That is **exactly** the idea behind me open sourcing it, just please mention me if you do use the material. 😬

And lastly, pay it forward. If you can share your research, your knowledge or your time please do it!

-- Ivan R.