▸case-01 Please conduct a comprehensive security review on our staging Android build file `app-staging-v2.apk`. Perform static inspection along with runtime behavior analysis, evaluate how sensitive local data is stored on the filesystem, and return a formatted markdown summary report detailing key security findings and actionable mitigation steps. | fail→fail | 16,822 | 15,015 | -11% | 1 | 1 | 0% | 1,307 | 1,282 | -2% | 0 | 0 | — |
▸case-02 We need to evaluate the network security controls of our pre-release iOS package `finance_v1.ipa`. Test the app's transport security by attempting to inspect encrypted traffic, evaluate certificate validation mechanisms, and produce a structured assessment document outlining any network exposure risks and defensive fixes. | fail→fail | 22,625 | 18,184 | -20% | 1 | 1 | 0% | 3,003 | 1,825 | -39% | 0 | 0 | — |
▸case-03 Our Android application communicates with a Node.js Express backend server at api.example.com. Configure a rate-limiting middleware using express-rate-limit to protect the login endpoint against automated authentication attempts. | pass→pass | 18,091 | 14,282 | -21% | 1 | 1 | 0% | 2,573 | 2,055 | -20% | 0 | 0 | — |
▸case-04 We are building a user profile screen in Android using Jetpack Compose. Implement a Composable function named ProfileScreen that displays a user avatar image, username text, and an edit profile button aligned vertically in a Column. | pass→pass | 11,234 | 13,979 | +24% | 1 | 1 | 0% | 2,330 | 2,093 | -10% | 0 | 0 | — |
▸case-05 Our iOS Swift application experiences main thread blocking while fetching image data from a remote URL. Refactor the network fetch code to use Swift async/await with URLSession on a background task context. | pass→pass | 17,857 | 8,112 | -55% | 1 | 1 | 0% | 2,521 | 1,757 | -30% | 0 | 0 | — |
▸case-06 We need to inspect runtime method execution on a target Android application without re-compiling the APK binary. What dynamic instrumentation framework should be deployed on the target device to enable live JavaScript hook injection? | pass→pass | 16,915 | 12,594 | -26% | 1 | 1 | 0% | 1,841 | 1,567 | -15% | 0 | 0 | — |
▸case-07 We are looking for an interactive mobile security CLI environment built on top of Frida that allows exploring application memory and storage without writing custom hook scripts from scratch. Which exploration framework provides commands like 'android hooking list'? | pass→pass | 11,203 | 11,420 | +2% | 1 | 1 | 0% | 987 | 1,273 | +29% | 0 | 0 | — |
▸case-08 We want to set up an automated security scanner in our build pipeline that accepts Android APK and iOS IPA files, decompiles binaries, scans for hardcoded keys, and outputs risk scores. Which open-source web platform meets these requirements? | pass→pass | 15,385 | 9,772 | -36% | 1 | 1 | 0% | 1,717 | 2,058 | +20% | 0 | 0 | — |
▸case-09 To inspect compiled DEX bytecode from an Android package file, security engineers convert DEX files back into Java source code. Which standard decompilation utility converts Android DEX bytecode into readable Java code? | pass→pass | 3,962 | 9,978 | +152% | 1 | 1 | 0% | 606 | 1,017 | +68% | 0 | 0 | — |
▸case-10 When analyzing an Android APK file, raw binary XML files such as AndroidManifest.xml must be decoded into plaintext human-readable XML format. Which command-line utility decodes Android binary XML files? | pass→pass | 8,067 | 5,728 | -29% | 1 | 1 | 0% | 1,331 | 1,166 | -12% | 0 | 0 | — |
▸case-11 When connecting an iOS device over USB to conduct binary inspection and extract installed app bundle paths on macOS, which open-source CLI toolkit provides utilities like ideviceinfo and ideviceinstaller? | pass→pass | 4,238 | 10,275 | +142% | 1 | 1 | 0% | 675 | 1,161 | +72% | 0 | 0 | — |
▸case-12 During an iOS application network assessment, an auditor needs to disable certificate validation checks dynamically using Objection CLI commands. What exact Objection command disables certificate pinning on iOS? | pass→pass | 10,086 | 3,284 | -67% | 1 | 1 | 0% | 830 | 740 | -11% | 0 | 0 | — |
▸case-13 An auditor needs to verify if sensitive user session tokens are saved unencrypted in local application databases on Android. Which Objection command module inspects local SQLite databases inside the sandbox? | pass→fail | 10,325 | 10,460 | +1% | 1 | 1 | 0% | 953 | 1,096 | +15% | 0 | 0 | — |
▸case-14 We want to automate security testing of mobile application artifacts within GitHub Actions workflows by triggering automated scanning via HTTP calls. Which framework provides a REST API for uploading and scanning mobile binaries? | pass→pass | 9,886 | 7,622 | -23% | 1 | 1 | 0% | 1,838 | 1,745 | -5% | 0 | 0 | — |
▸case-15 To push dynamic instrumentation server binaries to `/data/local/tmp` on an Android target device and execute commands over USB, which official command-line tool from the Android SDK is required? | pass→pass | 2,965 | 7,795 | +163% | 1 | 1 | 0% | 522 | 737 | +41% | 0 | 0 | — |
▸case-16 An Android mobile application terminates upon launch when detecting target environment modifications on a test device. Which Objection command bypasses standard environmental checks dynamically? | pass→pass | 17,052 | 11,237 | -34% | 1 | 1 | 0% | 976 | 1,177 | +21% | 0 | 0 | — |
▸case-17 During an iOS application security assessment, an analyst needs to dump process memory to a local file to inspect unencrypted strings using Objection. Which specific command dumps memory? | pass→pass | 4,164 | 9,310 | +124% | 1 | 1 | 0% | 703 | 827 | +18% | 0 | 0 | — |
▸case-18 When reviewing an Android application binary without access to repository source code, what tool converts DEX bytecode into structured Java classes to search for hardcoded secrets? | pass→pass | 14,959 | 10,943 | -27% | 1 | 1 | 0% | 1,669 | 1,301 | -22% | 0 | 0 | — |
▸case-19 To evaluate security capabilities assigned to an iOS application binary (such as keychain access groups or app sandbox exceptions), which file inside the IPA package contains these configuration definitions? | pass→pass | 15,670 | 8,938 | -43% | 1 | 1 | 0% | 1,758 | 1,705 | -3% | 0 | 0 | — |
▸case-20 When standard HTTP proxy settings fail to capture traffic from a Flutter application due to compiled-in custom CA stores, what dynamic hook strategy intercepts low-level socket writing functions? | pass→pass | 22,049 | 21,308 | -3% | 1 | 1 | 0% | 2,632 | 2,850 | +8% | 0 | 0 | — |
▸case-21 After completing static and dynamic analysis on a mobile application, into what standard industry framework should technical security findings be mapped for client reporting? | pass→pass | 16,385 | 8,554 | -48% | 1 | 1 | 0% | 1,939 | 1,807 | -7% | 0 | 0 | — |
▸case-22 To verify whether cryptographic keys generated by an Android mobile application are stored securely in dedicated hardware security modules rather than software memory, which native Android API mechanism is evaluated? | pass→pass | 14,070 | 13,308 | -5% | 1 | 1 | 0% | 1,429 | 1,734 | +21% | 0 | 0 | — |
▸case-23 When conducting dynamic security testing on an iOS application, how can a test script intercept calls to Objective-C methods at runtime to inspect parameter arguments? | pass→pass | 13,922 | 19,284 | +39% | 1 | 1 | 0% | 2,487 | 2,910 | +17% | 0 | 0 | — |