While performing a mobile application penetration test, a security consultant notices that the user password is being locally encrypted before it is sent to the back end for authentication. Which of…

Sandbox analysis involves observing an application's runtime behavior in an isolated environment, which is useful for malware analysis but typically does not directly expose the encryption algorithm or key from within the code.

Information leakage refers to the unintended exposure of sensitive data, which might hint at encryption but is not a systematic method for actively discovering the full algorithm and key from the application's logic.

Reverse engineering involves decompiling or disassembling the mobile application's binary code to examine its internal logic and functions. This process allows the consultant to trace how sensitive data, such as passwords, is encrypted, revealing the specific algorithms and potentially the hardcoded or dynamically generated keys used for encryption.

A brute-force attack attempts to guess passwords or keys by trying many combinations, which is ineffective for identifying an unknown encryption algorithm or efficiently finding complex keys embedded in code.