iOS: Keychain Extraction & Layered Secret Recovery

mobile · expert · +195 XP

Scenario

You have a jailbroken test device. An app stashes a session secret in the iOS keychain with weak kSecAttrAccessible protection, readable while the device is unlocked.

Attack path

Use keychain_dumper (or an objection ios keychain dump) to list items.
Locate the SecretBlob entry belonging to the target bundle id.
Developers layered three cheap transforms hoping to slow analysts down.

Recover the flag

Peel the layers in order: reverse the string → From Base64 → ROT13 (Caesar 13). CyberChef stacks these cleanly. The result is your per-user flag.

// graded hints — spend XP when stuck

// captured payload · multi

sJMwLwWxMQqzAwNjMy8kZQZgp2Acp25ypz9zYJguMKWvoTyunv1hnJSbL3yynl1mo2y7L2t=

Apply each step IN REVERSE ORDER: 1. Caesar cipher — shift 13. Letters wrap; non-letters preserved. 2. Decode the base64 blob to recover the flag. 3. The flag has been reversed character-by-character. Reverse it back.

// this payload is unique to your account — decode it, then submit the recovered hc{...} flag below

// submit flag

// no solves yet

Android: Defeat Certificate Pinning with Frida

// end of mobile

12 of 12 · mobile

// install app

Install hacking.community for fast access, offline reading, and push notifications. No app store needed.