Android and iOS Hacking CEH Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   You are performing a security assessment of an Android app that handles sensitive financial data. The app is designed to run on both rooted and non-rooted devices. During testing, you need to intercept and modify the app's network traffic and inspect its internal storage. The app uses certificate pinning and stores a database in its private data directory. You have a rooted test device. Which approach is most effective for this assessment?

   • ADisable SELinux on the device and use a packet capture app to record traffic, then use the Android Debug Bridge to copy the database.
   • BUse Frida to bypass certificate pinning and read the database directly from the app's private data directory.
   • CUse a rooted device to extract the APK, modify it to remove certificate pinning, re-sign it, and install it on the same device.
   • DInstall a custom CA certificate in the system trust store and use a proxy to capture traffic, then pull the database using adb backup.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   An iOS app uses a custom URL scheme to handle deep links. The app also uses the Keychain to store a session token. A tester discovers that the app does not validate the source of the URL and passes the URL parameters to a web service. Which attack is most likely to lead to account takeover?

   • ACraft a URL that triggers a password reset with an attacker-controlled token
   • BUse a keychain exploit to read the session token
   • CUse a phishing page to trick the user into entering credentials
   • DUse a memory corruption exploit in the app's binary
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   While analyzing an Android app, you find a content provider that is exported and has a method that reads files from the app's internal storage based on a path provided in the query. The app does not enforce any permission on the provider. What is the most direct way to exploit this vulnerability?

   • ADecompile the app and change the provider's exported attribute to false, then reinstall the app.
   • BSend an intent to the content provider to force it to open a WebView with a malicious URL.
   • CUse a malicious app to query the content provider with a crafted URI that requests a sensitive file from the app's internal storage.
   • DUse ADB to push a malicious file to the provider's directory and then trigger a broadcast to read it.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   During a mobile app assessment, you decompile an Android APK with jadx and notice that the app uses a WebView to display content from a remote server. The app enables JavaScript and adds a JavaScript interface that exposes a method to read files from the device's internal storage. The app also has an exported activity that can be launched by other apps. Which combination of issues should you report as the most critical?

   • AThe app stores data insecurely because the WebView loads remote content, and the JavaScript interface can be used to bypass the Android permission model.
   • BThe exported activity allows intent injection, and the WebView JavaScript interface can be abused to exfiltrate files if the WebView loads untrusted content.
   • CThe WebView is vulnerable to a denial-of-service attack because JavaScript is enabled, and the exported activity allows arbitrary code execution on the device.
   • DThe exported activity can be used to launch a phishing page, and the WebView JavaScript interface allows an attacker to modify the app's source code.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   An Android app is designed to run on both rooted and non-rooted devices. The app uses the Android Keystore to store a cryptographic key, but on a rooted device, an attacker with root access can potentially extract the key. The developer wants to mitigate this risk. Which approach is most effective?

   • AUse a key derived from the device's unique ID
   • BUse the Keystore with StrongBox and require user authentication for key use
   • CStore the key in the app's internal storage and rely on the sandbox
   • DUse a hardcoded key in the app's code
   Reveal Solution Discussion Select an answer first