Box: iOS — Sideloaded Replay
box · medium · +110 XP
// what is Box: iOS — Sideloaded Replay?
iOS sideloaded IPA strings + OAuth refresh-token replay — apps ship secrets in their binaries all the time. API keys, OAuth refresh tokens, signing keys — all sitting in plaintext inside the IPA. Once you have the refresh token, you can mint access tokens forever (or until the user notices and revokes). The scope field on access tokens is often over-trusted by backend endpoints.
// how attackers detect it
- [01]
strings -a app.ipa | grep -iE 'token|secret|key|api|password'— first 5 minutes of every mobile pentest. - [02]
r2 -e bin.strings.maxlen=4096 ./Payload/MyApp.app/MyAppto find Base64-encoded blobs. - [03]Once you have a refresh token, test what scopes you can mint. Backend often doesn't restrict the requested scope.
// how defenders prevent it
- ✓Never embed long-lived tokens in the binary. Use a backend-for-frontend (BFF) that holds them.
- ✓Use iOS Keychain / Android Keystore for runtime token storage — never
NSUserDefaults/SharedPreferences. - ✓Validate the
scopeclaim on every protected endpoint.adminis not a substring you should trust.
// real-world incidents
CVE-2022-32893
iOS WebKit RCE chained with token bleed
Real-world spyware chain.
CVE-2023-32434
iOS kernel privesc via XNU
Used in Triangulation attack — token theft was step 2.
// hands-on tips for this lab
- ›Step 1:
GET /ipa/strings→ findREFRESH_TOKEN=hc_rt_.... Step 2: POST it to/oauth/refresh→ get access token withscopecontainingadmin. Step 3: hit/v1/admin.
was this lesson helpful?
previous
Box: Kubernetes RBAC Escape
// end of box
9 of 9 · box