iOS UIActivity Sharing
Last updated
Last updated
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
From iOS 6 onwards, third-party applications have been enabled to share data such as text, URLs, or images using mechanisms like AirDrop, as outlined in Apple's Inter-App Communication guide. This feature manifests through a system-wide share activity sheet that surfaces upon interacting with the "Share" button.
A comprehensive enumeration of all the built-in sharing options is available at UIActivity.ActivityType. Developers may opt to exclude specific sharing options if they deem them unsuitable for their application.
Attention should be directed towards:
The nature of the data being shared.
The inclusion of custom activities.
The exclusion of certain activity types.
Sharing is facilitated through the instantiation of a UIActivityViewController, to which the items intended for sharing are passed. This is achieved by calling:
Developers should scrutinize the UIActivityViewController for the activities and custom activities it's initialized with, as well as any specified excludedActivityTypes.
The following aspects are crucial when receiving data:
The declaration of custom document types.
The specification of document types the app can open.
The verification of the integrity of the received data.
Without access to the source code, one can still inspect the Info.plist for keys like UTExportedTypeDeclarations, UTImportedTypeDeclarations, and CFBundleDocumentTypes to understand the types of documents an app can handle and declare.
A succinct guide on these keys is available on Stackoverflow, highlighting the importance of defining and importing UTIs for system-wide recognition and associating document types with your app for integration in the "Open With" dialogue.
To test sending activities, one could:
Hook into the init(activityItems:applicationActivities:) method to capture the items and activities being shared.
Identify excluded activities by intercepting the excludedActivityTypes property.
For receiving items, it involves:
Sharing a file with the app from another source (e.g., AirDrop, email) that prompts the "Open with..." dialogue.
Hooking application:openURL:options: among other methods identified during static analysis to observe the app's response.
Employing malformed files or fuzzing techniques to evaluate the app's robustness.
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
