Android and iOS Hacking CEH Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   You are analyzing an iOS app that uses a custom URL scheme to handle deep links. The app also stores a session token in the keychain with the kSecAttrAccessibleWhenUnlocked attribute. You discover that the URL scheme handler does not validate the source of the URL and that the app uses a vulnerable version of a third-party library that is susceptible to memory corruption. Which of the following is the most critical risk?

   • AThe memory corruption vulnerability can be exploited remotely without any user interaction because the URL scheme is registered.
   • BA malicious app can invoke the URL scheme to trigger the memory corruption vulnerability, potentially leading to arbitrary code execution within the app's sandbox.
   • CThe URL scheme can be used to bypass the app's sandbox and read the keychain directly.
   • DThe session token can be extracted by any app because the keychain attribute is insecure.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A security team is testing an iOS app that uses certificate pinning to prevent man-in-the-middle attacks. The team has a jailbroken test device and wants to bypass the pinning to intercept HTTPS traffic. Which approach is most effective?

   • AUse a tweak like SSL Kill Switch 2 or Frida to disable certificate validation
   • BUse class-dump to extract the pinned certificate and replace it
   • CUse a proxy without any modifications to the device
   • DInstall a custom CA certificate in the system trust store
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   An iOS app uses the Keychain to store a session token but does not set a data protection class, so it defaults to 'Always' (accessible even when the device is locked). A tester wants to demonstrate the risk of this misconfiguration. Which attack scenario is most relevant?

   • AAn attacker can use a URL scheme to trigger the app to reveal the token
   • BAn attacker can use a malicious app to read the token due to a missing access group
   • CAn attacker who steals the device can extract the token from the Keychain without unlocking the device
   • DAn attacker can use a memory corruption exploit to dump the Keychain
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which Android component is often misconfigured to allow arbitrary JavaScript execution and file access, making it a common target for attacks that steal cookies or inject malicious scripts?

   • AService
   • BWebView
   • CContent provider
   • DBroadcast receiver
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   An Android app has a WebView that loads remote content from a URL that includes user-supplied parameters. The app also enables JavaScript and does not restrict the URL scheme. A tester wants to demonstrate that a malicious URL can execute JavaScript in the WebView context. Which technique is most appropriate?

   • AUse Frida to hook the WebView's loadUrl method and inject code
   • BUse an intent to launch the WebView activity with a malicious extra
   • CCraft a URL with a javascript: scheme that executes arbitrary JavaScript
   • DUse a content provider to read the WebView's cache
   Reveal Solution Discussion Select an answer first