NSUserDefaults Storage
NSUserDefaults class is one more way data on the iOS device persists even after restart. The information stored NSUserDefaults class is stored in plaintext plist file.
In this exercise the app stores data using a NSUserDefaults file in the application sandbox.Your task is to locate the NSUserDefaults file and find the sensitive data that it contains.
When a user enters any random PIN number the application prompts to try Harder and If a valid PIN number is entered we get a status message as success as shown below;
NSUserDefaults files are usually found in the below given path;
#/private/var/mobile/Containers/Data/Application/<Application_Folder>/Library/Preferences/<NSUserDefaultsfile.plist>>
Download iGoat-Swift application files from the above path using SFTP/SCP to our host machine. Open the file using the Vim editor and you will see the data in binary, which is not in human-readable format:
╭─[email protected] ~/Documents/iOS/OWASP_iGoat
╰─$ scp [email protected]:/private/var/mobile/Containers/Data/Application/464B6C36-FBB9-4209-AC2C-6793098AB807/Library/Preferences/OWASP.iGoat-Swift.plist .
[email protected]'s password:
OWASP.iGoat-Swift.plist 100% 423 61.5KB/s 00:00
╭─[email protected] ~/Documents/iOS/OWASP_iGoat
╰─$ ls
OWASP.iGoat-Swift.plist
Open the file using the Vim editor and you will see the data in binary, which is not in human-readable format:
Let’s convert the binary file into the XML format so that we can read its contents. You can use the plutil utility to convert the binary file into the XML format and Once converted into XML format, you can observe the sensitive information in plain text, as shown in the following:
Aruns-iPhone:/private/var/mobile/Containers/Data/Application/464B6C36-FBB9-4209-AC2C-6793098AB807/Library/Preferences root# ls
OWASP.iGoat-Swift.plist
Aruns-iPhone:/private/var/mobile/Containers/Data/Application/464B6C36-FBB9-4209-AC2C-6793098AB807/Library/Preferences root# plutil -convert xml1 OWASP.iGoat-Swift.plist
Converted 1 files to XML format
Aruns-iPhone:/private/var/mobile/Containers/Data/Application/464B6C36-FBB9-4209-AC2C-6793098AB807/Library/Preferences root# cat OWASP.iGoat-Swift.plist
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>PIN</key>
<string>53cr3tP</string>
<key>WebDatabaseDirectory</key>
<string>/var/mobile/Containers/Data/Application/464B6C36-FBB9-4209-AC2C-6793098AB807/Library/Caches</string>
<key>WebKitLocalStorageDatabasePathPreferenceKey</key>
<string>/var/mobile/Containers/Data/Application/464B6C36-FBB9-4209-AC2C-6793098AB807/Library/Caches</string>
<key>WebKitOfflineWebApplicationCacheEnabled</key>
<true/>
<key>WebKitShrinksStandaloneImagesToFit</key>
<true/>
</dict>
</plist>
The data stored in NSUserDefaults is not secured and should not be used to store sensitive information.
Last modified 4yr ago