Manipulating Network Traffic GMOB Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   An analyst is testing a mobile app that uses TLS with mutual authentication (mTLS). The analyst has intercepted the traffic and wants to decrypt it. The analyst has the app's client certificate and private key. Which additional configuration is required in the proxy to successfully decrypt the traffic?

   • ADisable TLS interception and capture the traffic in plaintext.
   • BConfigure the proxy to present the client certificate to the server and use the private key to decrypt the session.
   • CUse a VPN to capture the traffic before encryption.
   • DInstall the proxy's CA certificate on the device and enable SSL/TLS interception.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   While analyzing intercepted traffic from a mobile banking app, a tester notices that the session cookie is not marked with the Secure flag and is sent over HTTP when the app falls back to a non-TLS connection. The tester wants to demonstrate the risk of session hijacking. Which action best proves the vulnerability?

   • ADelete the cookie from the proxy and resend the request to see if the server grants access without authentication.
   • BChange the cookie's domain attribute to a different domain and send the request to see if the server accepts it.
   • CReplay the captured HTTP request with the session cookie from a different device and show that the server accepts it.
   • DModify the cookie value in the intercepted request to a random string and observe the server's error response.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   After intercepting HTTPS traffic from a mobile app, an analyst sees a request to an endpoint that returns a JSON response with a field named 'isAdmin' set to false. The analyst wants to test if the server properly enforces authorization. Which action is most appropriate?

   • AChange the request method from GET to POST and observe the server's response.
   • BReplay the same request with a different user's session token to see if the server returns that user's data.
   • CModify the response to set 'isAdmin' to true and forward it to the app to see if the UI changes.
   • DRemove the 'isAdmin' field from the response and see if the app crashes.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An analyst is testing a mobile banking app for authorization flaws. The analyst intercepts a request to view account details and notices the request includes a numeric account ID in the URL. The analyst wants to test if the server properly verifies that the authenticated user owns the account. Which action should the analyst take?

   • ARemove the authentication token from the request and observe if the server rejects it.
   • BChange the account ID in the request to another user's account ID and observe if the response returns that user's data.
   • CReplay the same request multiple times to test for rate limiting.
   • DModify the HTTP method from GET to POST and resend the request.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A tester is fuzzing a mobile app's API and wants to identify input validation vulnerabilities. The tester has captured a valid request and wants to fuzz the 'id' parameter. Which approach is most effective?

   • AChange the 'id' parameter to a string and observe the server's response.
   • BManually change the 'id' parameter to a few common values like 0, -1, and a large number.
   • CReplay the same request multiple times with the same 'id' value to test for rate limiting.
   • DUse a fuzzing tool to send a large number of requests with random values for the 'id' parameter and monitor for anomalies.
   Reveal Solution Discussion Select an answer first