Skip to main content

Core Services Layer

The Core Services layer sits above Core OS and below the media and UI layers. It provides the foundation frameworks that every app links against, regardless of what it looks like. This is where most app data is created, stored, and transmitted, so for a pentester, this layer is where the juicy bits usually live.

Foundation​

Foundation is the workhorse: collections, strings, networking (NSURLSession, CFNetwork), file I/O, threading, serialization (JSON/PropertyList), and NSCoding/NSSecureCoding.

  • Property lists (.plist) are everywhere in iOS, from Info.plist to preferences.
  • NSUserDefaults is the classic "just store this setting" API, and a classic source of insecure data storage when developers stash tokens or plaintext settings in it.

CFNetwork​

CFNetwork is the low-level C networking framework underneath NSURLSession:

  • HTTPS/TLS handled via Secure Transport / Network framework.
  • Your main testing hooks: certificate pinning bypass, intercepting traffic with a proxy (Burp, mitmproxy), and inspecting NSURLSession delegates that accept arbitrary certificates.

SQLite​

  • The default embedded database used by almost everything on iOS, including Core Data's default store.
  • App databases live in the sandbox at Documents, Library, or tmp; grep for SQLite files to find cached user data, chat history, tokens, and PII.
find ~/Library/Developer/CoreSimulator/Devices -name "*.sqlite" 2>/dev/null

Core Data​

  • Apple's ORM/object-graph framework; by default it persists to a SQLite file (<AppName>.sqlite, plus -wal and -shm files).
  • The on-disk schema often mirrors the app's object model, which makes reverse engineering straightforward: entities, attributes, and relationships are visible in the .momd compiled model inside the bundle.

File Access​

  • App Sandbox container: everything an app reads/writes is inside its own container under /var/mobile/Containers/Data/Application/<UUID>/.
  • Standard directories: Documents (user data, backed up), Library (preferences, caches, databases), tmp (transient).
  • Security-relevant mistake: developers writing secrets (tokens, keys, passwords) into Documents, NSUserDefaults, or tmp without applying a Data Protection class. These get backed up to iTunes/iCloud and become extractable.

Services Apps Rely On​

  • NSUserDefaults: preferences plist (Library/Preferences/<bundle-id>.plist).
  • Keychain: the secure store, covered in the security features note.
  • Notification services (APNs, local notifications).
  • Location services (CoreLocation), contacts, calendars: all mediated by TCC (privacy prompts) and available only with user consent and an entitlement.

Pentest relevance​

  • App data lives in the sandbox container. On a non-jailbroken device, pull it via the app's own data containers (backup extraction, simulator, or app-specific documents sharing). On a jailbroken device, read the container directly.
  • Grep app containers and databases for hardcoded keys, tokens, and secrets. strings on the binary and SQLite dumps on the store are the bread and butter.
  • Watch for secrets stored in NSUserDefaults, in Documents (backup-able), or in Core Data without file protection. Each is a finding on its own.