Manipulating Network Traffic GMOB Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   An analyst is testing a mobile app that uses a custom binary protocol over TCP. The analyst has captured a session and wants to replay and modify the traffic to test for vulnerabilities. Which approach is most appropriate?

   • AUse a standard HTTP proxy to intercept and modify the traffic.
   • BUse a network replay tool that only replays the exact captured packets without modification.
   • CUse a scripting tool like Scapy or a custom Python script to parse, modify, and replay the captured packets.
   • DUse a TLS interception proxy to decrypt and modify the traffic.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   An analyst is testing a mobile app that uses OAuth 2.0 with refresh tokens. The analyst captures a refresh token and wants to test if the server properly validates the token's audience. Which test should the analyst perform?

   • AReplay the refresh token multiple times to test for replay attacks.
   • BUse the refresh token against a different client ID or resource server and observe if it is accepted.
   • CCheck if the refresh token expires after a short time.
   • DModify the refresh token's payload and keep the signature unchanged.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   An analyst is configuring a proxy for a mobile app that uses certificate pinning and also validates the certificate chain. The analyst has a rooted Android device and has installed a custom CA in the system trust store. The analyst has also used an Xposed module to bypass pinning. However, the app still fails to connect. What is the most likely remaining issue?

   • AThe device's system trust store does not include the proxy's CA.
   • BThe proxy is not configured to listen on the correct port.
   • CThe app validates the certificate chain against a pinned intermediate or root that is not the proxy's CA.
   • DThe app is using TLS 1.3, which the proxy does not support.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security analyst is testing a corporate mobile app that uses certificate pinning. The analyst needs to intercept the app's HTTPS traffic to a specific API endpoint to verify that the app does not leak sensitive data in query parameters. The analyst has root access to a test Android device and can modify the app's APK. Which approach is most effective for this assessment?

   • AInstall a user-supplied CA certificate on the device and configure a proxy to intercept traffic, relying on the app's default trust store.
   • BUse a DNS spoofing attack to redirect the API domain to a local server that logs plaintext requests, avoiding the need for a proxy.
   • CUse Frida to hook the app's certificate validation functions and disable pinning, then route traffic through a proxy with a custom CA installed as a system certificate.
   • DCapture traffic with tcpdump on the device and analyze the encrypted packets without decryption, since the query parameters are visible in the TLS handshake.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A penetration tester is assessing a mobile messaging app that uses a proprietary binary protocol over TCP. The tester has captured a session and wants to identify vulnerabilities in the server's handling of malformed messages. Which technique is most appropriate?

   • AUse a network fuzzer to replay the captured traffic with mutated fields and observe server responses for crashes or anomalies.
   • BUse a TLS interception proxy to decrypt the traffic and then replay the decrypted messages unchanged.
   • CUse a packet sniffer to capture additional traffic and manually inspect each byte for protocol documentation.
   • DUse a DNS rebinding attack to redirect the app's server connection to a local fuzzing server.
   Reveal Solution Discussion Select an answer first