all

Just unzip android Or IOS app and will see leak api or source code for api in applications .

after unzip IOS ipa it will be in this file :

1- cd /home/user/Desktop/Payload/AppName.app/public

2- leak source code and sensitive information will be in "main.js" such as :

• api path

• sensitive information for users or admin

and more ....

As a developer, you should be aware when using Cordova. Read this for more information: https://cordova.apache.org/docs/en/11.x/guide/appdev/security/index.html#do-not-assume-that-your-source-code-is-secure

i made template for that after you unzip the "ipa" use this command :

echo ~/app_folder | nuclei -t ~/cordova-bug/cordova-data.yaml

test in many apps even if android or IOS .