nerdexam
CompTIA

PT0-001 · Question #31

A company requested a penetration tester review the security of an in-house developed Android application. The penetration tester received an APK file to support the assessment. The penetration…

The correct answer is A. Convert to JAR. B. Decompile. Before performing SAST on an Android APK, the tester must convert the DEX bytecode to JAR format and then decompile it to obtain readable source code for analysis.

Vulnerability discovery and analysis

Question

A company requested a penetration tester review the security of an in-house developed Android application. The penetration tester received an APK file to support the assessment. The penetration tester wants to run SAST on the APK file. Which of the following preparatory steps must the penetration tester do FIRST? (Select TWO).

Options

  • AConvert to JAR.
  • BDecompile.
  • CCross-compile the application.
  • DConvert JAR files to DEX.
  • ERe-sign the APK.
  • FAttach to ADB.

How the community answered

(38 responses)
  • A
    76% (29)
  • C
    3% (1)
  • D
    3% (1)
  • E
    5% (2)
  • F
    13% (5)

Why each option

Before performing SAST on an Android APK, the tester must convert the DEX bytecode to JAR format and then decompile it to obtain readable source code for analysis.

AConvert to JAR.Correct

APK files contain classes.dex (Dalvik Executable) files rather than Java bytecode. Converting DEX to JAR using a tool like dex2jar produces a JAR file with Java bytecode that SAST tools can process.

BDecompile.Correct

After converting to JAR, the bytecode must be decompiled into human-readable Java source code using tools like JD-GUI or jadx so that static analysis can be performed on the application logic and structure.

CCross-compile the application.

Cross-compiling is the process of building source code for a different target architecture and is not a step in statically analyzing an already-packaged APK.

DConvert JAR files to DEX.

Converting JAR to DEX is the reverse of what is needed - DEX is the format inside the APK that must be converted TO JAR, not the other way around.

ERe-sign the APK.

Re-signing an APK is required for dynamic testing or reinstallation after modification, not as a prerequisite for static source code analysis.

FAttach to ADB.

Attaching to ADB (Android Debug Bridge) is a dynamic analysis technique used for runtime inspection and is not part of a SAST workflow.

Concept tested: Android APK static analysis preparation steps

Source: https://mas.owasp.org/MASTG/techniques/android/MASTG-TECH-0017/

Topics

#Android security#APK analysis#SAST#mobile application testing

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full PT0-001 Practice