# Low-Hanging Apples: Hunting Credentials and Secrets in iOS Apps

iOS app obfuscated AWS client/secret keys extracted via Frida hooking of AWSCredentials initKey: during profile picture upload, exposing S3 credentials.

- Payout: Research
- Severity: high
- Program: Apple
- Write-up by: Eugene Lim
- Disclosed: 2019-12-29
- Write-up quality: 6/10
- Original: https://spaceraccoon.dev/low-hanging-apples-hunting-credentials-and-secrets-in-ios-apps/
- Library page: https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-low-hanging-apples-hunting-credentials-and-secrets-in-ios-apps
- Tags: area:mobile domain:mobile impact:data-leak kind:research platform:research sev:high tech:aws tech:ios tech:s3 technique:reverse-engineering technique:source-review vuln:secrets-leak

**Target:** iOS application binary / AWS S3 upload credentials
**Root cause:** Developer embedded AWS client and secret keys in the app, obfuscated but still passed in plaintext to the initKey: method at runtime, so client-side secrets are recoverable.
**Steps:**
1. Dump IPA: `iproxy 2222 22`, then `./dump.py <BUNDLE ID>`
2. Unzip IPA and move `.app` contents to AppFiles
3. Grep for `API_KEY` and inspect `Info.plist` via `plutil -p`
4. Launch Objection: `objection --gadget <APPNAME> explore`
5. `ios hooking list classes` and grep for AWS/Amazon
6. `ios hooking watch class AWSCredentials`
7. Trigger profile picture upload in app
8. `ios hooking watch method "-[AWSCredentials initKey:]" --dump-args` and re-trigger upload to dump `<AWS CLIENT KEY>:<AWS SECRET KEY>`
**How found:** Noticed the app uploaded profile pictures to S3 but the request was hidden from interception and no plaintext creds in app files; reasoned that credentials must be passed in plaintext to some method at runtime, so hooked AWS-named classes to dump arguments.
**Exploitation:** Attacker with device access dumps the IPA, identifies the AWSCredentials class, hooks initKey: with Frida/Objection, triggers the upload flow, and reads the plaintext AWS client and secret keys from the argument dump, gaining the app's S3 credentials.
**Insight:** When creds are obfuscated and traffic is hidden, don't reverse the crypto—enumerate classes with `ios hooking list classes`, watch classes matching the SDK (e.g. AWS), and dump args of init/setup methods triggered by a specific app action like an upload.