Looting iOS App's Cache.db

This report describes an insecure-by-default behavior in iOS mobile applications where NSURLSession caches network responses to an unencrypted Cache.db SQLite database that commonly contains session tokens, credentials, and sensitive server data. It details attack paths for obtaining Cache.db (device access, iCloud or local backups), and provides step-by-step techniques to extract and convert embedded binary PLIST blobs from Cache.db for discovery of exposed secrets, along with mitigation recommendations for developers.