# LAB - iOS: Hardcoded Secrets

## Lab Environment

In this lab environment, you will get access to a Debian machine, which has all the required tools installed on it for this lab, along with an IPA file.

**Objective:** Perform static analysis on the IPA file to find the hardcoded API key.

The following file can be useful:

* reqnest.ipa: Present on the "Desktop".

### Tools

* unzip
* strings
* grep

## Flag

* What is a hardcoded API key value?

We can see into the Desktop folder a file with name "`reqnest.ipa`", unzip it -->

```
cd Desktop
ls
unzip reqnest.ipa
```

<figure><img src="https://3697469405-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSrcwXlKGkwhzbrKa8vLU%2Fuploads%2FHGTCT4mmS9HQr89bQOEr%2Fimage.png?alt=media&#x26;token=6409a741-1bda-4f67-b478-04d732270923" alt=""><figcaption></figcaption></figure>

Into this zip/ipa we can see a reqnest filne, so use `strings` to read leggible words -->

```
strings reqnest | grep api
```

<figure><img src="https://3697469405-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSrcwXlKGkwhzbrKa8vLU%2Fuploads%2FzikoLohDPzCIDGZHrSGl%2Fimage.png?alt=media&#x26;token=636b50d8-7604-42da-9ab4-ac2ad1f0a6b1" alt=""><figcaption></figcaption></figure>

