312-50 Question 406
Single answer▪ Mobile Security Guidelines and ToolsA security consultant is performing an authorized assessment of an Android mobile banking application used by a financial services company. The client wants to know whether sensitive data such as authentication tokens, cached account data, or API keys are being stored insecurely on the device. The consultant has a rooted test device and needs a practical approach that aligns with common mobile security testing guidance. Which tool would be the MOST appropriate to quickly inspect the application's local storage areas such as shared preferences, SQLite databases, and internal files on the Android device?
- A
Drozer, because it can interact with Android app components and help enumerate and assess application attack surface and local data exposure
- B
Wireshark, because it is designed to browse Android application sandbox files and extract SQLite databases from the device
- C
Nmap, because it can enumerate the banking application's private storage directories over ADB and identify insecurely stored tokens
- D
Aircrack-ng, because it can analyze the application's local caches and recover encrypted shared preference values from the device
Show answer and explanation
Correct answer: A
Explanation
For this scenario, the consultant needs an Android-focused application security assessment tool rather than a network or wireless analysis utility. Drozer is appropriate because it is specifically used to assess Android application attack surface, exported components, permissions, and data exposure, which fits the client's concern about sensitive data being stored or exposed locally. In real-world testing, consultants often combine Drozer with ADB, run-as where permitted, or direct filesystem review on rooted devices to inspect /data/data/<package_name>/ for shared_prefs, databases, and files. This aligns with common mobile testing guidance such as the OWASP Mobile Application Security Testing Guide (MASTG), which emphasizes reviewing local storage for insecure handling of credentials, tokens, and cached sensitive data. Wireshark, Nmap, and Aircrack-ng are valid security tools in other contexts, but they do not address the primary requirement of inspecting Android application local storage.
- A. Correct.
Correct. Drozer is a well-known Android security assessment framework used to interact with applications, enumerate exposed components, and assess issues such as insecure content providers, exported activities/services, and local data exposure. In a practical CEH-style mobile assessment, Drozer is an appropriate choice for examining whether an app's data and components are exposed in ways that could leak sensitive information. While a tester may also use ADB and direct filesystem inspection on a rooted device, among the listed tools Drozer is the best fit for Android application-level local security assessment.
- B. Incorrect.
Incorrect. Wireshark is primarily a network protocol analyzer used to capture and inspect traffic. It is useful for identifying insecure transmission of data, weak TLS usage, or plaintext API calls, but it is not designed to browse Android app sandbox directories or directly inspect shared preferences and SQLite databases stored on the device.
- C. Incorrect.
Incorrect. Nmap is a network discovery and port scanning tool. It helps identify hosts, ports, services, and network exposure, not inspect private application storage on an Android device. Choosing Nmap here reflects the misconception that any security assessment tool can be applied to mobile app filesystem analysis.
- D. Incorrect.
Incorrect. Aircrack-ng is a wireless network security suite used for assessing Wi-Fi security, such as capturing frames and testing wireless keys. It has no role in inspecting Android application local storage or extracting shared preferences and databases from an app sandbox.