Apple Secure Notes Help
#1
Hey everyone!

I am brand new to this whole thing and have been trying to learn all I can. My wife has Apple Notes that are locked with a password that she can't remember. I have tried everything from using every password we know of to jailbreaking an iPad and trying to pull it down from there. 

After some research, I found hashcat. I am trying to see where a good start is. I have dabbled in it and when I run using the brute force method, it doesn't show there are any hashes available. I know there is a password on them though and can see them protected when looking at the file in a DB explorer.

I think I am pulling the correct file in (NoteStore.sqlite) and I can see data in it. 

What am I doing wrong here or where is a good start?

Thanks guys!!
Reply
#2
Use this script to extract the hash from NoteStore.sqlite
Clean the output till it has the same format as you find here. (search for Apple Secure Notes)
Try to crack it with hashcat using -m 16200.
Reply