Reviewing data storage on iOS: containers, backups and the Keychain
You audit the data an iOS app leaves behind using prepared exports: container folders, plists and databases, caches and cookies, backup contents and the protection levels of Keychain items.
Level 301 · 22 lessons · 18 practice labs
Lessons
The app container
- Layout of the container: Documents, Library, Caches, tmp
- Reviewing preference plists
- Reviewing SQLite and Core Data stores
- WAL files and traces of deleted data
- Short task: list the files holding sensitive data in a container export
Caches and side channels
- The URL cache and binary cookie files
- App switcher snapshots and the keyboard dictionary
- WebKit data: local storage and IndexedDB
- Sensitive data in a system log export
- Shared containers: data held in common with extensions
- Short task: find the response holding credentials left in the cache database
Backups
- The structure of a backup: Manifest.db and file hashes
- Finding an app's files in a backup
- Excluding files from backup and auditing it
- How encrypted and unencrypted backups differ in content
- Short task: find the session file that should not be in a backup
Keychain and protection
- Reading a Keychain listing: accessibility and access group
- This-device-only items and items that travel with backups
- Auditing file protection classes
- Writing a storage finding and verifying the fix
- Short task: find the item left always-accessible in a Keychain listing
Capstone
- Capstone: audit the iOS storage of a law firm's document app
Practice labs
- Read the preferences plist in a container export: Decode the file under Library/Preferences and list its keys.
- List the files holding sensitive data in a container: Find the files holding client data in the container of Sedirli Hukuk Bürosu's document app.
- Find traces of deleted records in a Core Data store: Examine the SQLite and WAL files and report the records thought deleted.
- List the responses in the URL cache database: Extract the request URLs in Cache.db.
- Find the response with credentials left in the cache: Find the response containing a token in the cache and write a cache policy recommendation.
- Decode the binary cookie file and assess the session cookies: Decode the cookies and report those with no expiry and no secure flag.
- Find the app switcher snapshots: Find the snapshot folder in the container and list its files.
- Report a sensitive screen visible in a snapshot: Attach the image showing the account screen as evidence and recommend a fix.
- Find what the app leaks in a system log export: Filter the lines from the app's subsystem in the log and classify the personal data written openly.
- List an app's files from Manifest.db: Query the records for the given bundle ID in the training backup.
- Find the session file that should not be in a backup: Go from the file hash to the real file and prove its contents.
- Verify an exclusion fix with two backups: Compare the backups of the old and fixed versions and show the file no longer enters the backup.
- Find an app's items in a Keychain listing: Filter the items by access group.
- Find the item left always-accessible: Report the item with a weak accessibility value and what data it holds.
- Classify items by portability and protection: Tabulate all items by accessibility, sync and access control and recommend three fixes.
- Write one storage finding with evidence: Turn the plaintext token in a preferences file into a finding note.
- Report a file protection class audit: Write up the three weakly protected files from the protection class listing as findings.
- Audit the iOS storage of a law firm's document app: Gather container, cache, backup and Keychain findings in one report.
About this course
You audit the data an iOS app leaves behind using prepared exports: container folders, plists and databases, caches and cookies, backup contents and the protection levels of Keychain items.
What you will learn
- The app container
- Caches and side channels
- Backups
- Keychain and protection
- Capstone
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.