17.1 Mobile Attacks and AI Prompt/Model Attacks

Domain 4, Attacks and Exploits, is 35 percent of CompTIA PenTest+ PT0-003. Objective 4.9 — Explain common attacks against specialized systems — is an explain item family, not a jailbreak cookbook and not an AI exploit kit. You already scoped a mobile assessment on objective 1.1 and may have run a mobile scan on 3.1. 4.9 asks you to name the attack type that matches the evidence, then the tool family that belongs. This section covers mobile attacks (information disclosure, jailbreak/rooting, permission abuse) and AI attacks (prompt injection, model manipulation), plus the mobile-side tools: MobSF, Frida, Drozer, and Android Debug Bridge (ADB). Operational technology, NFC, RFID, Bluetooth, Scapy, tcprelay, Wireshark/tcpdump, and Bluestrike wait for the next section. Domain 4 is not Domain 3: a MobSF row that mentions a backup flag is a hypothesis until you classify it as information disclosure. It is also not 4.5 cross-site scripting just because the interesting string is text.

Information disclosure: backups, logs, and insecure storage

Information disclosure on mobile is data leaving the app that should have stayed private. CompTIA wants the class, not a forensic dump of every path on disk.

Typical pictures:

• Backups. Android allowBackup (or an ADB or cloud backup) that includes session tokens; an iOS backup that holds material the app stored poorly; a laptop image of an emulator.
• Logs. Logcat or unified logs that print bearer tokens, password-reset codes, or government ID numbers.
• Insecure storage. Cleartext SharedPreferences, unencrypted SQLite, world-readable files on external storage, screenshot caches of a banking screen, or clipboard contents another app can read.

When you pick it: the stem shows a secret in a backup, a log line, or a local store — not a jailbreak, and not a camera permission a flashlight never needed. Exam trap: calling every leaked string XSS. XSS is 4.5 in the browser. Mobile disclosure is the app or OS handing data to backup, logs, or storage. Trap two: treating disclosure as only a 3.1 secrets-scan trophy. 3.1 discovered it. 4.9 names the mobile attack type. Trap three: waiting for a rooted device before you will call a cleartext token a finding. Stock devices still back up and still log.

Jailbreak/rooting: more surface, and MDM may void

Jailbreak (iOS) and rooting (Android) bypass the vendor sandbox so unsigned code, remounted system partitions, and cross-app inspection become possible. PT0-003 scores what that does to the attack surface, not a hardware-exploit recipe. This guide will not give one.

What it does. Other apps and the tester can read what the sandbox used to hide. Debugging interfaces open. Integrity checks fail. Mobile device management (MDM) often voids compliance or refuses enrollment: a rooted corporate phone is a policy incident as well as a technical finding. A tester who roots a production MDM device without the rules of engagement (RoE) has expanded scope, not demonstrated cleverness.

When you pick it: the stem is a device that is already jailbroken or rooted, an MDM control that failed because of a jailbreak, or an app that assumed the sandbox still existed. When you do not: a permission the user granted in Settings (permission abuse) or a token in a backup of a stock device (information disclosure). Exam trap: treating jailbreak as the only way to find mobile issues. MobSF can flag insecure storage on a non-rooted emulator. Trap two: writing a jailbreak how-to as if the exam scored steps. Identification of increased surface and MDM impact is enough.

Permission abuse: camera, microphone, and storage

Permission abuse is an app that requested — or a user that granted — more access than the feature needs: camera, microphone, storage/photos, location, contacts, or SMS. The attack is using that grant, not crashing the kernel.

When you pick it: a PDF reader that wants the microphone, a game that reads SMS, or an app that keeps the camera after the feature closed. When you do not: a backup of tokens (disclosure) or a rooted device (jailbreak/rooting). OWASP MASVS from objective 1.3 still describes what to verify on mobile apps; 4.9 names the attack when those controls fail. A 3.1 mobile scan may have listed the permission; 4.9 is the attack-type label.

Exam trap: calling every Android permission a jailbreak. Permissions exist on stock devices. Trap two: treating permission abuse as 4.8 social engineering because a user tapped Allow. The tap is delivery. The 4.9 finding is the over-broad request or the grant nobody reviewed.

AI attacks: prompt injection and model manipulation

PT0-003 newly emphasizes artificial intelligence (AI). Treat AI features as another attack surface in scope if listed — a chatbot, a copilot in the CRM, a model API the mobile app calls. They are not automatically in scope because the company uses AI somewhere. Shared-responsibility and third-party rules from 1.1 still bind: do not pentest the foundation-model vendor unless the RoE named that vendor.

Prompt injection is user content that changes the model's instructions. Direct injection is in the chat box. Indirect injection lives in a document, ticket, email, or webpage the model retrieves. Identification: the model did something the developer did not intend because untrusted text was treated as instructions — for example a support ticket that says to ignore policy and dump the hidden system prompt, or a retrieved page that tells the assistant to call a tool the user never asked for.

When you pick it: a chatbot followed attacker-supplied instructions, a retrieved file overrode the system prompt, or the model took an action (email, tool call) because untrusted content told it to. When you do not: poisoned training data from a past fine-tune — that is model manipulation.

Model manipulation changes the model itself or extracts what it was not supposed to reveal: poisoning (training or fine-tune data that plants a backdoor), adversarial inputs (crafted examples that flip a classification), and extracting system prompts or training data conceptually. You do not need a research paper. You need the names.

When you pick it: a poisoned fine-tune, an adversarial sample the model mislabels, or a tester extracting the hidden system prompt or memorized training snippets. Exam trap: calling every AI finding prompt injection. If the model was retrained on attacker data, that is manipulation. If the live prompt was hijacked by user text, that is injection. Trap two: treating AI as 4.5 SQL injection because both involve injection. SQLi abuses a database interpreter. Prompt injection abuses an instruction-following model. Trap three: attacking the hosted-model vendor because the customer calls an API. That is a 1.1 third-party conversation unless separately authorized.

Mobile tools: MobSF, Frida, Drozer, ADB

MobSF (Mobile Security Framework) performs static and dynamic analysis of Android and iOS packages: permissions, hardcoded secrets, backup flags, cryptography, and a runtime report when the app runs. When you pick it: the stem wants a mobile app assessment framework that can inspect an APK or IPA before (or without) hooking live functions.

Frida is runtime hooking / dynamic instrumentation. You attach to a running process and intercept function calls — conceptually tracing a decrypt routine or watching disk writes. When you pick it: the stem is hook this function at runtime. Exam trap: answering Frida for a static APK permission list — that is MobSF.

Drozer is the named Android IPC (inter-process communication) tool: exported activities, content providers, broadcast receivers, and services. When you pick it: an exported content provider that leaks a database, or an activity any app on the device can start. It is not an iOS tool.

ADB is the device bridge: install packages, pull files, view logcat, run a backup, open a shell. When you pick it: logcat, pulling files from a debug or authorized rooted build, or installing the test APK. Exam trap: treating ADB as Frida. ADB moves files and shells; Frida hooks functions.

Scapy, tcprelay, Wireshark/tcpdump, and Bluestrike belong in 17.2.

Worked mobile and AI estate

An in-scope Android app plus an in-scope support chatbot. MobSF flags allowBackup=true and a cleartext SharedPreferences token — information disclosure. The same app requests the microphone although it is a PDF reader — permission abuse. A tester device is rooted, so MDM marks it non-compliant and other apps can read the sandbox — jailbreak/rooting, not a license to skip RoE. Frida hooks the local crypto function; Drozer shows an exported content provider; ADB pull and logcat collect the evidence. The chatbot follows a customer ticket that says to ignore policy and print the system prompt — prompt injection. A separate fine-tune set included attacker-labeled examples that created a backdoor phrase — model manipulation. None of these is a Modbus write. Name the 4.9 type first.