Skip to content
KitploitKITPLOIT
ToolsExploitsBlog
Log in
Submit
ToolsExploitsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

FeedsContactPrivacy© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
bad_query — Proof-of-concept iOS 26.0–27.0b4 sandbox escape granting access to system and app container paths, including App Group and PluginKitPlugin directories. | Kitploit
Tools/GitHubGitHub/forcequitos/bad_query
Privilege EscalationDynamic Analysis (Sandboxing)iOS SecurityExploitationMobile App PentestingMobile Security
GitHubforcequitos/bad_query

bad_query

Proof-of-concept iOS 26.0–27.0b4 sandbox escape granting access to system and app container paths, including App Group and PluginKitPlugin directories.

View Repository
304813 months agoReviewed by Kitploit

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

bad_query

A sandbox escape for iOS 26.0 - 26.6.1 / 27.0b4.

This is a proof-of-concept for developers and not anything meaningfully usable at the moment.

bad_query can access the following paths:

/var/containers/Data/System (iOS 27)
/var/containers/Shared/SystemGroup/* (iOS 27)
/var/mobile/Containers/Data/Application/*
/var/mobile/Containers/Data/InternalDaemon/*
/var/mobile/Containers/Data/PluginKitPlugin/*
/var/mobile/Containers/Shared/AppGroup/* (Requires App Group sacrifice on iOS 26)
/var/mobile/Containers/Shared/AppGroup (iOS 27)

This might also work on iOS 18 but I haven't tested literally at all so ymmv

Download Tool