26

I am storing username and password of my application in iOS keychain. I am developing the application using Appcelerator and am using the following module. Through the API, I can perform all the CRUD operations ob both device and simulator.

After reading few blogs and topics on penetration testing for keychain, I came to know the keychain information is stored on a SQL database. My objective is to find this particular database and open to read its content. I want to see that the information has been stored there (accepted that the data will be encrypted and all gibberish) but hoping that there will be an identifier which will specify the access group.

I just want to open the database, check the table and ensure that the content has been saved in that table. I will be performing this entire task on iOS 9.3 simulator as I do not have a jail-broken device.

3
  • If you want to dump the keychain table , you need a jailbraken device. github.com/ptoomey3/Keychain-Dumper .
    – user5890979
    Jan 25, 2017 at 22:42
  • Will that not be possible to do the same thing using iOS Simulator?
    – Soumya
    Jan 25, 2017 at 22:43
  • raywenderlich.com/45645/ios-app-security-analysis-part-1 , this is an outdated guide and I have not checked if it is working nowadays. But thats a complete guide how to do it on the simulator if possible, I think, (not read through it all) but thats all I could find for you. :)
    – user5890979
    Jan 25, 2017 at 22:45

1 Answer 1

81

This should not be anything too hard, especially having in mind that you are prepared to see "encrypted and gibberish" content in there.

You should simply go to ~/Library/Developer/CoreSimulator/Devices folder and find UUID of your desired simulator whose Keychain you want to access. Once you have found which UUID-named folder belongs to your Simulator, go inside that folder and go to data/Library/Keychains folder.

In there, you will see keychain-2-debug.db file which is the SQLite database file you are looking for.

After that, use a tool like http://sqlitebrowser.org/ to browse the database.

SQLite browser

I managed to find things I was writing into Keychain when I have opened the database with this tool, then going to Browse Data and picking up genp for the table. After that, check agrp column field value, because it shows who wrote that entry to Keychain database. You will find stuff you wrote with your app by spotting TEAMID.com.your.app.bundle.id value in there.

Cheers

6
  • 18
    To find the UUID of the device in your simulator, enter xcrun simctl list | egrep '(Booted)' in the terminal. Shout out to TiBooX at stackoverflow.com/questions/6952279/… for this lovely gem. Aug 2, 2018 at 13:58
  • @c4k - Are you asking for the code snippet used to read value from the Keychain that got written?
    – uerceg
    Aug 17, 2018 at 7:48
  • @uerceg no I was wondering how to read the data in sqlite browser (if it is possible)
    – c4k
    Aug 17, 2018 at 14:57
  • 1
    @c4k Ah. Sorry, didn't understand you at first. Honestly, I never tried it nor I think it's possible. I was simply writing the values in Keychain from my app and verified if they were successfully written by reading them also from the app and comparing with what I tried to write.
    – uerceg
    Aug 20, 2018 at 7:22
  • 1
    To find the UUID of a device, you can now look in the device_set.plist found in the ~/Library/Developer/CoreSimulator/Devices folder.
    – danfordham
    May 9, 2019 at 16:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.