Android and iOS Hacking CEH Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   In the iOS security architecture, which hardware component is responsible for protecting the device's cryptographic keys and performing Touch ID/Face ID authentication?

   • AApplication sandbox
   • BXNU kernel
   • CCode signing
   • DSecure Enclave
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which iOS exploitation technique involves sending a crafted URL to an app that uses a custom URL scheme, potentially leading to unauthorized actions or data exposure?

   • AKeychain attack
   • BMan-in-the-middle attack
   • CMemory corruption
   • DURL scheme exploitation
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   In a structured mobile app security assessment, which phase involves gathering information about the app's components, permissions, and third-party libraries before performing deeper analysis?

   • AStatic analysis
   • BReconnaissance
   • CReporting
   • DDynamic analysis
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   You are testing an iOS app that uses the keychain to store a refresh token. The app also uses a custom URL scheme for OAuth callbacks. You discover that the keychain item is accessible to other apps signed with the same team ID, and the URL scheme handler does not validate the state parameter. Which of the following is the most critical risk?

   • AA malicious app signed with the same team ID can read the refresh token from the keychain and use it to access the user's account.
   • BThe URL scheme can be used to inject a malicious state parameter and perform a CSRF attack on the OAuth flow.
   • CThe app's sandbox can be escaped by sending a crafted URL to the URL scheme handler.
   • DThe URL scheme can be used to perform a phishing attack by redirecting the user to a malicious login page.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   An Android app has a WebView that loads content from a URL that is constructed using user input. The app enables JavaScript and sets the WebView's JavaScript interface to expose a native method that can access the device's contacts. A tester wants to exploit this to steal contacts. Which attack is most effective?

   • ACraft a URL that injects JavaScript to call the exposed native method
   • BUse a content provider to read the WebView's cache
   • CUse Frida to hook the WebView's loadUrl method and inject code
   • DUse an intent to launch the WebView activity with a malicious extra
   Reveal Solution Discussion Select an answer first