What problem does it solve? Reverse-engineering how an iOS app builds signed requests, enforces certificate trust, and stores secrets is difficult when static analysis alone cannot reveal runtime behavior. This Skill provides a structured CTF-sandbox workflow for tracing Objective-C and Swift execution, inspecting Keychain and plist state, and replaying accepted requests. ## Core Features & Use Cases - Static iOS Triage: Maps Info.plist, entitlements, URL schemes, universal links, embedded frameworks, and Keychain access groups before any dynamic work. - Targeted Runtime Hooking: Hooks request builders, crypto helpers, trust evaluators, and Keychain accessors with Frida instead of noisy UI handlers, capturing plaintext inputs, nonces, and signed headers. - Request Replay: Rebuilds the smallest stateful sequence of token, device identifier, body, signature, and headers that the server accepts. - Use Case: During a mobile CTF challenge, you hook the app's request signer to recover the signing transform, bypass SSL pinning just enough to observe traffic, and replay a valid authenticated request outside the app. ## Quick Start Ask the agent to hook the target IPA's request builder and Keychain reads with Frida, then replay the accepted signed request after the ctf-sandbox-orchestrator has established sandbox assumptions.
