Which of the following tasks should the penetration tester do first?

A penetration tester is working on a security assessment of a mobile application that was developed in-house for local use by a hospital. The hospital and its customers are very concerned about disclosure of information.

Which of the following tasks should the penetration tester do first?
A . Set up Drozer in order to manipulate and scan the application.
B . Run the application through the mobile application security framework.
C . Connect Frida to analyze the application at runtime to look for data leaks.
D . Load the application on client-owned devices for testing.

View Answer

Answer: B

Explanation:

When performing a security assessment on a mobile application, especially one concerned with information disclosure, it is crucial to follow a structured approach to identify vulnerabilities comprehensively.

Here ’ s why option B is correct:

Mobile Application Security Framework: This framework provides a structured methodology for assessing the security of mobile applications. It includes various tests such as static analysis, dynamic analysis, and reverse engineering, which are essential for identifying vulnerabilities related to information disclosure.

Initial Steps: Running the application through a security framework allows the tester to identify a broad range of potential issues systematically. This initial step ensures that all aspects of the application’s security are covered before delving into more specific tools like Drozer or Frida. Reference from Pentest:

Writeup HTB: Demonstrates the use of structured methodologies to ensure comprehensive coverage of security assessments.

Horizontall HTB: Emphasizes the importance of following a structured approach to identify and address security issues.