MonkeHacks #19

iOS Hacking, Primate Pack 2.0, Scotland

Author

Monke
June 24, 2024

MonkeHacks #19

I arrived in Edinburgh on Tuesday. For now, I’m cooped up in a hostel while I attend viewings to find somewhere to live. I hung out with my good friend Mikey96. We did some security research and just caught up on life in general - it was great!

I finally found a few bugs this week, which made me feel a lot better. Despite many hours of hacking, I had quite a long bugless streak this week, so I’m glad it ended positively. I’m starting to get a lot better at client-side hacking (all the brutal JS business).

Edinburgh. I sat in this park and read my book (“The Trial” by Kafka).

100-Hour Challenge Updates

Here are this week’s statistics:

⌛️ Hours This Week

8

⏳️ Hours Left

17

🗞️ Total Reports (All-Time)

3

✅ Total Triages (All-Time)

3

✨ New Triages (This Week)

0

💸 Bounties 

$25533

I spent some time looking at the mobile app using my new iOS setup. It yielded a lead, but sadly the lead didn’t go anywhere this time. Other than that, the functionality was quite limited, so back to the drawing board. I need to examine the traffic I have for new attack vectors. I think I can pop one more decent bug in the next 17 hours.

Weekly Ideas / Notes 

  • I thought the developer phase was over, but apparently, it wasn’t! I rewrote the Primate Pack from the ground up. The previous plugin was written in plain JS and largely depended on EvenBetter. This time, I’ve implemented some major changes:

    • I changed the UI framework to make it easier for me to add new features to it.

    • The entire plugin is now written in TypeScript and is now built to be imported using Caido’s official plugin system rather than the deprecated one written into EvenBetter.

    • I’ve finished migrating Caido Pets.

    • You can expect this new version to be released sometime towards the end of next week, as I’m also adding new features before release. If you have any relatively easy but useful extension ideas, send them my way.

  • I set up an iOS hacking environment this week, following the rough instructions kindly provided by Evan Connelly. This is a complete iOS hacking game-changer for me. However, a few days later, Evan himself posted a blog post explaining exactly how to do it! You can read that here.

  • Thanks to all that Typescript practice, I’m pretty decent at full-stack development now. I’ll be putting this to good use in the next few months.

Resources