Mobile Application Penetration Testing

Hardcoded username and password

There are potential possibilities that developers leave behind backdoors within apps. In our case, this happens while we do a deep analysis of the class dump.

The following code snippet displays ApplicationPatchingDetailsVC, an interesting interface that includes a username and password:

  @interface ApplicationPatchingDetailsVC : UIViewController <UITextFieldDelegate> {
    UITextField* _usernameTextField;
   UITextField* _passwordTextField;
  }

Let's now load the app into Hopper, and in the labels, let's type ApplicationPatchingDetailsVC, as shown in the following screenshot:

In the right pane, if you click on the Pseudo code ...