‫Instructor: Hi, within this lecture,
‫we are going to learn a very good tool,
‫called Cycript or Cycript
‫and we're going to see how we can leverage this tool,
‫in order to bypass this jailbreak,
‫in order to manipulate the app in a way that we want.
‫So before we start using this tool,
‫first of all we have to make sure,
‫that the Cycript is installed in our jail broken device.
‫And in order to do that,
‫of course I'm going to open my Cydia app,
‫like we have done before
‫and I'm going to download Cycript.
‫So maybe you have skipped the previous sections,
‫about routing or jail breaking.
‫So that's what we use.
‫The Cydia is what we use in order to download
‫and install third party apps, okay?
‫Rather than using app store itself.
‫So make sure you open the Cydia app
‫and it should be there,
‫if you're using a jail broken device, okay?
‫And make sure you follow along with me to install Cycript.
‫So over here we see the installed applications,
‫on our iPad or our iPhone.
‫So maybe Cycript has pre-installed for you,
‫maybe it hasn't, it really doesn't matter.
‫Just come over here to search bar
‫and search for Cycript, okay?
‫And it's spelled like this CYC, okay?
‫And then as you can see,
‫it appears at the bottom of this page, this one.
‫So the creator of this tool,
‫spells or pronounces this as script,
‫but the rest of the world pronounces this Cycript,
‫so I'm gonna go for Cycript
‫and as you can see it's installed for me,
‫if you just hit on this modify or install button,
‫it can install it for you
‫and I'm going to reinstall it so that you can see,
‫what you are going to see when you do that, okay?
‫And as you can see, it's still installing.
‫Now it'll just install it and reboot it
‫and it'll be ready for our use.
‫So what does this tool do?
‫It allows us to connect to the app,
‫connect to our jail broken device
‫and then to the app and try to get the information,
‫out of that related app
‫and try to execute some commands on that app,
‫try to read the data and manipulate the data as well.
‫So this is a very useful tool,
‫if you want to manipulate the apps in an easy way,
‫rather than just going for hex editing,
‫which is very hard to do, you can go for the Cycript, okay?
‫So once you see this restart springboard,
‫you can just hit on the restart springboard
‫and it will reboot it.
‫And of course it's gonna take a little bit time,
‫to reboot and then it'll be ready for your use.
‫But make sure you install because it's very life saving tool
‫and it's also very effective as well.
‫You're going to see what I mean in a minute.
‫And after your jail broken device reboots,
‫just make sure you open it
‫and actually make sure you install the SSH as well.
‫If you have skipped the jail broken section,
‫just go to that section where we talk about routing
‫and jail breaking and then install SSH as well.
‫So I'm going to delete this Detect Jail IPA from here
‫because we have done a lot of installing and stuff,
‫so I'm going to just reinstall it,
‫I'm going to just upload it to my iPad, okay?
‫I'm not gonna change anything over here.
‫It's the same IPA that we have been working on,
‫but I just want to make sure that it's fresh
‫and it's working, okay?
‫So let me go to Appleid.apple.com.
‫So I'm not explaining this because by now,
‫I believe you know how this works.
‫I'm going to use Impactor,
‫in order to upload this to my iPad, okay?
‫So let me just give this two factor authentication.
‫Even though I say remember me every time,
‫it doesn't remember, I dunno why.
‫So let me create a password for this app.
‫So I'm gonna call this test six and here you go,
‫here is my password,
‫I'm just going to bring this down and say okay
‫and it will just actually upload this IPA to my iPad.
‫So here you go.
‫Now I believe we are ready to use it.
‫Now once you install the Cycript or Cycript
‫and once you install your IPA,
‫now you're ready to rock and roll.
‫But before we do that, let me assure you,
‫that this is working, as you can see it works.
‫So I haven't changed anything.
‫So it still detects that I'm using a jail broken device.
‫So let me move this over here
‫and we're gonna have to SSH into our iPad
‫or jail broken iPhone.
‫So remember how you can SSH into your iPad.
‫So if you haven't seen your local IP address,
‫from your own iPad, you can find it,
‫from your local router administrator board as well,
‫by typing 192,168,11
‫or you are gonna have to call your internet provider,
‫to ask how you can reach your administrator panel, okay?
‫But once you reach it, you can see,
‫every local IP in your house and every device as well.
‫So let me show you how this works.
‫If I go to my home network,
‫I can see all the devices and allocated IP addresses
‫and as you can see my iPad is actually using,
‫192, 168, 131 over here
‫and you can see that inside of the iPad or iPhone as well,
‫I have shown you how to find this information before,
‫so I'm gonna cut this quick,
‫I'm going to just SSH into this IP address.
‫So these are all connected to the same network by the way.
‫So let me give my password and here you go.
‫I'm inside of my iPad right now.
‫Now I can write and execute some commands in my iPad,
‫using this terminal.
‫So here we go.
‫What we want to do over here is to run the Cycript command.
‫So we are going to have to switch to the Cycript shell.
‫So in order to do that I'm going to run Cycript
‫and let me bring this up so we can follow it along.
‫So make sure your detect jail application is working,
‫like this, okay?
‫If it's not working, just click on it and open it
‫and then just run the Cycript-P for process
‫and you're gonna have to write the name of this IPA,
‫which is detect jail, okay?
‫Like this.
‫And once you do that, it will run Cycript,
‫against this detect jail
‫and now you can actually run some Cycript code.
‫So here we go.
‫And once we run and execute some Cycript code,
‫it will execute it using the information of the app.
‫For example, if I run something like this UI app,
‫we can see the UI application values
‫and it really doesn't make any sense right now,
‫but if I add something to it like this UI app,
‫that key window, okay?
‫Dot root view controller,
‫So root view controller means the first view controller,
‫first screen that we see when we run this app,
‫so as you can see it's named view controller,
‫if it was named something else,
‫then we would have seen this over here.
‫Now we get the view controller
‫and we have seen there is a second view controller,
‫in the assembly code as well.
‫So we are certain that there are,
‫two view controllers in this app
‫and now we're inside of the first one
‫and we want to go to the second one,
‫in order to capture the flag and see the values,
‫inside of the second view controller, okay?
‫So the main thing that I want to manipulate in this app,
‫is the function that is being called,
‫when the test button is clicked, right?
‫So I don't know that function yet.
‫So there are a couple of ways to understand that function
‫and understand which function are actual present in this app
‫and which function is doing what.
‫So first of all, you can try to do that within Cycript
‫and you can run JavaScript code in Cycript,
‫in order to understand the available methods.
‫I'm gonna show you very good documentation for that.
‫As you can see, there is a website called Cycript Tricks
‫and you can reach it through iPhone.wiki.net, okay?
‫And you can see there are a lot of efficient Cycript codes,
‫very good Cycript codes in order to use,
‫in your penetration tests like this getting methods,
‫so as you can see there is something called getting methods
‫and it apparently gives us the methods inside of this app.
‫So I'm going to copy it and paste it over here.
‫Assume that you don't know anything about JavaScript,
‫you can just copy in a paste it from that website, okay?
‫For useful methods and most of the time you can understand,
‫what's going on just by looking at it.
‫Maybe you cannot write it,
‫but you can read it obviously if you know about Swift
‫or if you know about Java, okay?
‫As you can see there is something called print methods,
‫it's a function, it takes some parameters like class name
‫and if you give some class name,
‫like view controller over here,
‫it'll give the methods of that view controller in return.
‫So I'm going to pass in view controller,
‫as a parameter over here and I will try this print methods
‫and as you can see, once I do that,
‫it crashed and it didn't give me the available methods.
‫So this sometimes happens
‫and this sometimes happens for no reason at all
‫and most of the time it works, okay?
‫You get to see the methods inside of this app,
‫but sometimes as you can see,
‫it doesn't work even though I do it one more time,
‫you will see that it won't work.
‫So let me just call this one more time
‫and I'm going to say view controller, okay?
‫Maybe you see the methods right now, but I cannot see it,
‫as you can see it crashes.
‫So if something like this happens,
‫then don't worry, 'cause there are a couple of other ways,
‫to learn about available methods as well.
‫For example, we still have our assembly code, right?
‫We can try to get some hints and clues,
‫out of that assembly code again.
‫So here we go, it doesn't work.
‫And I even closed down the Cycript for some reason.
‫I believe I have hit command C for some reason by mistake,
‫but it really doesn't matter,
‫I can just call it one more time,
‫but before we do that,
‫I'm gonna go for hopper disassembler, okay?
‫Let me open the hopper from scratch
‫and let me deep dive into this a little bit more,
‫so that maybe we can understand and get some more clues
‫and hints regarding to our test button.
‫So if you look at the left pane or labels,
‫you can see there is something called test button function,
‫let's see, we see the test button
‫and the main thing to do over here,
‫main idea is to search for test and I believe, yeah,
‫this is called test clicked, okay?
‫And most of the time developers will use the buttons name,
‫in the functions like test button click,
‫result button click, sent button click
‫and so that you can understand where it's located.
‫If you go to this diagram show,
‫from the first tab or second tab,
‫if you highlight the test button click,
‫you can go over here to second tab,
‫to understand it in a better way.
‫So if you look at our, if you look at this diagram,
‫then there are a couple of ways to go.
‫It starts and then there are two ways to path.
‫And over here it says that jail break hacker, okay?
‫Like we are seeing right now, once we click it, okay?
‫So this should be the case,
‫where it understands that it detects,
‫that the device is jail broken
‫and over here we have another path
‫and as you can see there is actually some kind of,
‫two second VC Segway over here.
‫So it takes us to second view controller
‫and in fact we wanna go to that way,
‫not the other way around, right?
‫So if you search for a second view controller,
‫you will see the second view controller over here.
‫Now in a case like this,
‫most of the time you can try to change the view controller,
‫without having to tread in anything else like this.
‫So I'm gonna show you how I'm gonna write,
‫Cycript P detect jail
‫and I'm going to say,
‫UIapp.keywindow.rootviewcontroller, okay?
‫Like this.
‫And rather than calling this
‫and getting the name of the view controller,
‫I'm going to make this equal to second view controller,
‫like that and you have to open one brace
‫and make sure that second view controller,
‫is spelled like this and write alloc and close the brace
‫and then say init and close the other brace as well
‫and then you can just hit enter.
‫Now when you do that,
‫it should take you to the second view controller.
‫But again, as you can see, it doesn't.
‫So it can be because of some bug
‫or it can be because of some protection, but it can work.
‫But in this, in our case, it doesn't work.
‫So we have to find another way to go into the second screen,
‫which is actually what I want,
‫because it should be very easy,
‫to change the view controller using this.
‫But we are not looking for easiness over here,
‫rather than easiness we are going to focus on this.
‫As you can see there is some selector called,
‫there is a function called isjailbroken over here.
‫And it all starts with this
‫and then it's just creates two paths,
‫out of this isjailbroken selector.
‫So what we really wanna do is to understand,
‫how we can change this isjailbroken function,
‫so that we don't see the left hand side,
‫but we always end up at the right hand side, okay?
‫So this is exactly what we are going to do using Cycript.
‫However, this lecture is gone too far.
‫So I'm going to stop here
‫and continue within the next lecture.