iOS Serialisation and Encoding

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

Code na maelezo zaidi katika https://mas.owasp.org/MASTG/iOS/0x06h-Testing-Platform-Interaction/#object-persistence.

Uwekaji wa Vitu katika Maendeleo ya iOS

Katika iOS, uwekaji wa vitu unahusisha kubadilisha vitu kuwa katika muundo ambao unaweza kuhifadhiwa au kuhamishwa kwa urahisi, na kisha kuyajenga tena kutoka katika muundo huu inapohitajika. Protokali mbili kuu, NSCoding na NSSecureCoding, zinawezesha mchakato huu kwa ajili ya Objective-C au NSObject subclasses, kuruhusu vitu kuwekewa katika NSData, muundo unaofunga buffer za byte.

NSCoding Utekelezaji

Ili kutekeleza NSCoding, darasa lazima irithi kutoka NSObject au iwe imewekwa alama kama @objc. Protokali hii inahitaji utekelezaji wa mbinu mbili za kuandika na kusoma mabadiliko ya mfano:

class CustomPoint: NSObject, NSCoding {
var x: Double = 0.0
var name: String = ""

func encode(with aCoder: NSCoder) {
aCoder.encode(x, forKey: "x")
aCoder.encode(name, forKey: "name")
}

required convenience init?(coder aDecoder: NSCoder) {
guard let name = aDecoder.decodeObject(forKey: "name") as? String else { return nil }
self.init(x: aDecoder.decodeDouble(forKey: "x"), name: name)
}
}

Kuimarisha Usalama kwa NSSecureCoding

Ili kupunguza udhaifu ambapo washambuliaji wanaingiza data kwenye vitu vilivyoundwa tayari, NSSecureCoding inatoa itifaki iliyoboreshwa. Madarasa yanayokubaliana na NSSecureCoding yanapaswa kuthibitisha aina ya vitu wakati wa ufafanuzi, kuhakikisha kwamba ni aina za vitu zinazotarajiwa pekee ndizo zinazoanzishwa. Hata hivyo, ni muhimu kutambua kwamba ingawa NSSecureCoding inaboresha usalama wa aina, haifanyi usimbaji wa data au kuhakikisha uadilifu wake, hivyo inahitaji hatua za ziada za kulinda taarifa nyeti:

static var supportsSecureCoding: Bool {
return true
}

let obj = decoder.decodeObject(of: MyClass.self, forKey: "myKey")

Data Archiving with NSKeyedArchiver

NSKeyedArchiver na mwenzake, NSKeyedUnarchiver, zinawezesha kuandika vitu kwenye faili na baadaye kuvipata. Mekanism hii ni muhimu kwa kuhifadhi vitu:

NSKeyedArchiver.archiveRootObject(customPoint, toFile: "/path/to/archive")
let customPoint = NSKeyedUnarchiver.unarchiveObjectWithFile("/path/to/archive") as? CustomPoint

Using Codable for Simplified Serialization

Protokali ya Codable ya Swift inachanganya Decodable na Encodable, ikirahisisha uandishi na usomaji wa vitu kama String, Int, Double, nk, bila juhudi za ziada:

struct CustomPointStruct: Codable {
var x: Double
var name: String
}

Huu njia inasaidia serialization rahisi kutoka na kwenda kwenye orodha za mali na JSON, ikiboresha usimamizi wa data katika programu za Swift.

Mbadala wa Uandishi wa JSON na XML

Mbali na msaada wa asili, maktaba kadhaa za wahusika wa tatu zinatoa uwezo wa uandishi/kuandika JSON na XML, kila moja ikiwa na sifa zake za utendaji na maelezo ya usalama. Ni muhimu kuchagua maktaba hizi kwa makini, hasa ili kupunguza udhaifu kama mashambulizi ya XXE (XML External Entities) kwa kuunda waandishi wa habari ili kuzuia usindikaji wa vitu vya nje.

Maelezo ya Usalama

Wakati wa kuandika data, hasa kwenye mfumo wa faili, ni muhimu kuwa makini kuhusu uwezekano wa kujumuisha taarifa nyeti. Data iliyosajiliwa, ikiwa itakamatwa au kushughulikiwa vibaya, inaweza kufichua programu kwa hatari kama vitendo visivyoidhinishwa au uvujaji wa data. Inapendekezwa kuandika na kusaini data iliyosajiliwa ili kuboresha usalama.

Marejeleo

• https://mas.owasp.org/MASTG/iOS/0x06h-Testing-Platform-Interaction/#object-persistence

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.