How do I access an iOS app's SQLite database?

Question

I am a penetration tester. I want to access my app's SQLite database in the in market app (if possible). How can I do this? Do I need a jailbroken phone? If so, how do I jailbreak a test device and then how do I access the database. What tools can I use?

Answer 1

You don't always need a jailbroken phone but it definitely helps. One way you can access an app's SQLite3 databases (if app backups are enabled) is by backing the phone up to iTunes and then extracting the SQLite3 db's from there.

See the following TrustedSec resource on extracting secrets from iOS apps' Cache.db files:

https://trustedsec.com/blog/looting-ios-apps-cache-db

The same principal and technique you see used in the above link apply to all of your application's regular SQLite3 db's. The Cache.db is just a special use case / attack vector you can take advantage of in misconfigured applications. I've seen AWS Cognito temporary credentials in there, AES encryption keys, etc... It's a very useful method to attack iOS SQLite3 dbs.

If you need to jailbreak your iPhone, you'll likely want to check out https://pangu8.com/ for more information on how to do that. If you're actually a penetration tester, you should know how to do all of these things. If you have to regularly perform penetration tests against iOS applications, I would suggest talking to your manager about investing in software designed to help facilitate this process.

I use Corellium, an iOS "emulation" tool, which works fantastically for running iOS apps. To read more about it, see the following URL: https://corellium.com. It has Frida ( https://frida.re/ ) built into the application so you can hook functions, debug and bypass protections to properly analyze the app. It gives you access via a web app to the phone's graphical interface, automatically installs cydia and some custom tooling into the phones to make the experience much more fluid.

What I tell most pentesters who are new to iOS and Mobile testing in general is that half of the penetration test is just getting the device set up (when you're first getting started at least). For future reference, try to phrase your question in a more singular way, as opposed to having 2-3 questions in the same post so that you get better results, but I hope this helps.