5 ms·

> Mobile apps have no choice but to use HTTP APIs. You can easily download a lot of iOS apps through the Mac App Store, then run strings on their bundles to loo

by sccxy 2y ago

> Mobile apps have no choice but to use HTTP APIs. You can easily download a lot of iOS apps through the Mac App Store, then run strings on their bundles to look for endpoints. Are there any good tutorials for that? 'strings' is not the greatest name for searching good information.

mooreds 2y ago
I googled a bit and found this, which points to some other tools. https://www.corellium.com/blog/ios-mobile-reverse-engineering https://www.corellium.com/blog/ios-mobile-reverse-engineerin... (No affiliation.)
out-of-ideas 2y ago
gnu strings: (first google result from "gnu strings" search) https://sourceware.org/binutils/docs/binutils/strings.html https://sourceware.org/binutils/docs/binutils/strings.html
syntaxing 2y ago
I was about to post the exact thing, I dont see any thing API related to iOS apps on Google. Edit: After some Google-ing and trying it on my macbook, there is a native CLI tool called "strings". Supposedly it does the following: strings is primarily used to find and display printable character sequences in binary files, object files, and executables. Which means the author is probably looking at the app to see the hardcorded characters in the app binary(?) and searching for the API end points.
- emilamlom 2y ago
  Just for context, strings is super commonly used when reverse-engineering anything. It's a great first-step because it's easy, fast, and get's some decent clues to help you get your bearings in an unknown binary file.
  - anthk 2y ago
    Among 'nm' and 'binwalk e $FILE'.
JonChesterfield 2y ago
strings is a unix program that shows you strings in a binary file
instalabs 2y ago
Not sure what "strings" is, but I always use Charles Proxy to inspect traffic for any mobile app: https://apps.apple.com/us/app/charles-proxy/id1134218562 https://apps.apple.com/us/app/charles-proxy/id1134218562
jonhohle 2y ago
`strings` is the Unix command line utility[0] of the same name. strings file will tell you all of the ASCII strings in file. 0 - https://www.unix.com/man-page/osx/1/strings/ https://www.unix.com/man-page/osx/1/strings/
- poincaredisk 2y ago
  strings -el For utf-16 encoded ascii strings (very useful when dealing with windows executables).
deleted 2y ago
[deleted]
spondyl 2y ago
Just to clarify a bit more for those who are new to strings and because the audience for the post may learn towards people fresher to reverse engineering: While most of the time, you're dealing with variables and such in programs, at some point you have to hardcode some information such as URLs to query so something like BASE_URL = "https://example.com https://example.com" result = requests.get(BASE_URL + "/api/blah" If we pretend this is in an Android app which is stored as an apk file (a zip file basically), running strings would spit out "https://example.com https://example.com" and "/api/blah" It'll also spit out anything that appears to be an ASCII character so plenty of junk but it's often quite handy as a starting point. There are, of course, much more precise tools such as man in the middle proxying but that you'll only capture traffic for endpoints actually used by said app. The app may contain other endpoints let unused, rarely triggered and so on.
TeMPOraL 2y ago
"strings" is a Unix CLI utility that automates the equivalent of a tried and true practice on Windows: opening an executable file in Notepad.exe and scrolling around until you find human-readable text (usually near the end of the file).
sva_ 2y ago
If you want to RE some android apps HTTP or even HTTPS, it's more straight-forward to use httptoolkit and frida. Might be a bit rough the first time you do it, but once its set up its a breeze. You can intercept calls and even modify etc https://httptoolkit.com/blog/frida-certificate-pinning/ https://httptoolkit.com/blog/frida-certificate-pinning/ https://github.com/httptoolkit/frida-interception-and-unpinning https://github.com/httptoolkit/frida-interception-and-unpinn...
- pimterry 2y ago
  This is actually now built into HTTP Toolkit, so it's easier than it sounds - if you connect a rooted device, there's an "Android app with Frida" interception option that installs Frida and runs the scripts above for you against any given app on the device automatically. Funded by the EU! https://nlnet.nl/project/AppInterception/ https://nlnet.nl/project/AppInterception/

by sccxy 2y ago

mooreds 2y ago

I googled a bit and found this, which points to some other tools. https://www.corellium.com/blog/ios-mobile-reverse-engineering https://www.corellium.com/blog/ios-mobile-reverse-engineerin... (No affiliation.)

out-of-ideas 2y ago

gnu strings: (first google result from "gnu strings" search) https://sourceware.org/binutils/docs/binutils/strings.html https://sourceware.org/binutils/docs/binutils/strings.html

syntaxing 2y ago

I was about to post the exact thing, I dont see any thing API related to iOS apps on Google. Edit: After some Google-ing and trying it on my macbook, there is a native CLI tool called "strings". Supposedly it does the following: strings is primarily used to find and display printable character sequences in binary files, object files, and executables. Which means the author is probably looking at the app to see the hardcorded characters in the app binary(?) and searching for the API end points.

emilamlom 2y ago
Just for context, strings is super commonly used when reverse-engineering anything. It's a great first-step because it's easy, fast, and get's some decent clues to help you get your bearings in an unknown binary file.
- anthk 2y ago
  Among 'nm' and 'binwalk e $FILE'.

JonChesterfield 2y ago

strings is a unix program that shows you strings in a binary file

instalabs 2y ago

Not sure what "strings" is, but I always use Charles Proxy to inspect traffic for any mobile app: https://apps.apple.com/us/app/charles-proxy/id1134218562 https://apps.apple.com/us/app/charles-proxy/id1134218562

jonhohle 2y ago

`strings` is the Unix command line utility[0] of the same name. strings file will tell you all of the ASCII strings in file. 0 - https://www.unix.com/man-page/osx/1/strings/ https://www.unix.com/man-page/osx/1/strings/

poincaredisk 2y ago
strings -el For utf-16 encoded ascii strings (very useful when dealing with windows executables).

deleted 2y ago

[deleted]

spondyl 2y ago

Just to clarify a bit more for those who are new to strings and because the audience for the post may learn towards people fresher to reverse engineering: While most of the time, you're dealing with variables and such in programs, at some point you have to hardcode some information such as URLs to query so something like BASE_URL = "https://example.com https://example.com" result = requests.get(BASE_URL + "/api/blah" If we pretend this is in an Android app which is stored as an apk file (a zip file basically), running strings would spit out "https://example.com https://example.com" and "/api/blah" It'll also spit out anything that appears to be an ASCII character so plenty of junk but it's often quite handy as a starting point. There are, of course, much more precise tools such as man in the middle proxying but that you'll only capture traffic for endpoints actually used by said app. The app may contain other endpoints let unused, rarely triggered and so on.

TeMPOraL 2y ago

"strings" is a Unix CLI utility that automates the equivalent of a tried and true practice on Windows: opening an executable file in Notepad.exe and scrolling around until you find human-readable text (usually near the end of the file).

sva_ 2y ago

If you want to RE some android apps HTTP or even HTTPS, it's more straight-forward to use httptoolkit and frida. Might be a bit rough the first time you do it, but once its set up its a breeze. You can intercept calls and even modify etc https://httptoolkit.com/blog/frida-certificate-pinning/ https://httptoolkit.com/blog/frida-certificate-pinning/ https://github.com/httptoolkit/frida-interception-and-unpinning https://github.com/httptoolkit/frida-interception-and-unpinn...

pimterry 2y ago
This is actually now built into HTTP Toolkit, so it's easier than it sounds - if you connect a rooted device, there's an "Android app with Frida" interception option that installs Frida and runs the scripts above for you against any given app on the device automatically. Funded by the EU! https://nlnet.nl/project/AppInterception/ https://nlnet.nl/project/AppInterception/