Categories: Kali Linux

Introspy – Security Profiling For Blackbox iOS

Introspy is a Blackbox tool to help understand what an iOS application is doing at runtime and assist in the identification of potential security issues.

Introduction to Introspy tool

This is the repository for the Introspy-iOS tracer.

The tracer can be installed on a jailbroken device to hook and log security-sensitive iOS APIs called by applications running on the device. The tool records details of relevant API calls, including arguments and return values and persists them in a database. Additionally, the calls are also sent to the Console for real-time analysis.

The database can then be fed to Introspy-Analyzer, a Python script to generate HTML reports containing the list of logged function calls as well as a list of potential vulnerabilities affecting the application.

Also Read BLEAH – A BLE Scanner For SMART Devices Hacking

Dependencies

The tracer will only run on a jailbroken device. Using Cydia, make sure the following packages are installed:

  • dpkg
  • Cydia Substrate
  • PreferenceLoader
  • Applist

How to install

Download and copy the Debian package to the device; install it:

scp <package.deb> root@<device_ip>:~
ssh root@<device_ip>
dpkg -i <package.deb>

Respring the device:

killall -HUP SpringBoard

There should be two new menus in the device’s Settings. The Apps menu allows you to select which applications will be profiled while the Settings menu defines which API groups are being hooked.

Finally, kill and restart the App you want to monitor.

How to uninstall

dpkg -r com.isecpartners.introspy

Generating HTML Reports

The tracer will store data about API calls made by applications in a database stored on the device (actually one in each application’s folder). This database can be fed to a Python script call Introspy-Analyzer in order to generate HTML reports that make it a lot easier to review the data collected by the tracer. The script will also analyze and flag dangerous API calls in order to facilitate the process of identifying vulnerabilities within iOS applications.

 

R K

Recent Posts

cp Command: Copy Files and Directories in Linux

The cp command, short for "copy," is the main Linux utility for duplicating files and directories. Whether…

6 days ago

Image OSINT

Introduction In digital investigations, images often hold more information than meets the eye. With the…

6 days ago

cat Command: Read and Combine File Contents in Linux

The cat command short for concatenate, It is a fast and versatile tool for viewing and merging…

6 days ago

Port In Networking

What is a Port? A port in networking acts like a gateway that directs data…

6 days ago

ls Command: List Directory Contents in Linux

The ls command is fundamental for anyone working with Linux. It’s used to display the files and…

6 days ago

pwd Command: Find Your Location in Linux

The pwd (Print Working Directory) command is essential for navigating the Linux filesystem. It instantly shows your…

7 days ago