Controlling the View Controllers in iOS Applications – Automatically

No ratings

Presented at BSidesPhiladephia 2019 by

Tomer Hadad

When life gives you doors, search for windows. As time goes by, performing security assessments requires more and more in-depth knowledge with many platforms and technologies. iOS applications security assessments are no exception. Exactly for that reason, we need to constantly find new approaches and tools to do more, with less (time, effort, resources...). Often, bypassing client -side controls in iOS applications, requires advanced skills and a time-consuming combination of tools and techniques to hook just the right method with just the right values, and move forward to the desired flow in the application. But how easy would that be if we could simply enumerate all of the application's screens and components and forcefully load the interesting ones? Meet Scwapper. This talk will cover what iOS view controllers are and their role in security, the hierarchy tree, how to manipulate the view controllers and the ease of doing so with Scwapper.