Study guide
17.1 Mobile Attacks and AI Prompt/Model Attacks
CompTIA PenTest+ PT0-003
Track your progress as you read
Finished sections get a check mark.
1 Introduction & Exam Overview
1.1 Current PT0-003 Exam Facts 1.2 Format, PBQs, Scoring, and Retake Policy 1.3 Recertification, CEUs, and Career Fit
2 Pre-Engagement Planning
2.1 Scope, Rules of Engagement, and Agreements 2.2 Target Selection and Assessment Types 2.3 Shared Responsibility, Legal Authorization, and Ethics
3 Collaboration, Frameworks, and Threat Modeling
3.1 Collaboration, Escalation, and Stakeholder Communication 3.2 Testing Frameworks and Methodologies 3.3 Threat Modeling: STRIDE, DREAD, and OCTAVE
4 Reporting and Remediation
4.1 Penetration Test Report Components 4.2 Findings Analysis and Remediation Recommendations
5 Information Gathering
5.1 Active vs Passive Reconnaissance 5.2 OSINT Sources and Techniques 5.3 DNS, Certificate Transparency, and Search Engine Enumeration 5.4 Network Recon, Protocol Scanning, Sniffing, and Banner Grabbing
6 Enumeration Techniques
6.1 OS Fingerprinting, Service Discovery, and Host Discovery 6.2 DNS, Directory, Share, and Account Enumeration 6.3 Secrets, Permissions, and Wireless Enumeration 6.4 WAF Enumeration, Web Crawling, and Attack Path Mapping
7 Recon Scripting and Tools
7.1 Modifying Bash, Python, and PowerShell for Recon 7.2 Recon and Enumeration Tools
8 Vulnerability Scan Types
8.1 Network, Host, Authenticated, and Wireless Scans 8.2 SAST, DAST, IAST, SCA, IaC, and Mobile Scans 8.3 Container, Secrets, and ICS Vulnerability Assessment 8.4 Core Vulnerability Scanners (Nessus, OpenVAS, Nikto)
9 Scan Analysis and Physical Security
9.1 Specialized Discovery Tools 9.2 Validating Scan, Recon, and Enumeration Results 9.3 Public Exploit Selection and Scripted Validation 9.4 Physical Security Concepts for PenTests
10 Attack Prioritization and Preparation
10.1 Target Prioritization: CVSS, CVE, CWE, and EPSS 10.2 Exploit Selection, Customization, and Attack Documentation
11 Network Attacks
11.1 On-Path, VLAN Hopping, Relay, and Multihomed Hosts 11.2 Default Credentials, Misconfigured Services, Packet Crafting, and Certificate Services
12 Authentication Attacks
12.1 Pass-the-Hash, Pass-the-Ticket, Pass-the-Token, and Kerberos Attacks 12.2 Password Attacks, MFA Fatigue, LDAP Injection, OIDC, and SAML
13 Host-Based Attacks
13.1 Privilege Escalation and Credential Dumping 13.2 Process Injection, Security Bypass, and Host Attack Tools
14 Web Application Attacks
14.1 SQL, Command, XSS, and SSTI Injection 14.2 CSRF, SSRF, Deserialization, IDOR, and Directory Traversal 14.3 LFI/RFI, Web Shells, API Abuse, JWT, and Session Hijacking
15 Cloud Attacks
15.1 IAM Misconfiguration, Metadata Service, and Exposed Storage 15.2 Container Escape, Supply Chain, and Cloud Attack Tools
16 Wireless and Social Engineering
16.1 Wireless Attacks and Tools 16.2 Phishing, Spearphishing, Whaling, Vishing, and Smishing 16.3 Physical Social Engineering and SE Tools
17 Specialized Systems
17.1 Mobile Attacks and AI Prompt/Model Attacks 17.2 OT/ICS, NFC, RFID, and Bluetooth Attacks
18 Attack Scripting and BAS
18.1 PowerShell, Python, and Bash Attack Automation 18.2 Breach and Attack Simulation (Caldera, Infection Monkey, Atomic Red Team)
19 Persistence
19.1 Scheduled Tasks, Services, Accounts, and Shells 19.2 C2, Backdoors, Rootkits, and Security-Control Tampering
20 Lateral Movement
20.1 Pivoting, Relays, and Additional Credential Capture 20.2 Remote Services: SMB, RDP, WinRM, WMI, SSH, and Others 20.3 Lateral Movement Tools and LOLbins
21 Exfiltration and Cleanup
21.1 Staging and Exfiltration 21.2 Cleanup, Restoration, and Artifact Preservation
17.1 Mobile Attacks and AI Prompt/Model Attacks
Key Takeaways Explain This Topic AI
Domain 4 Attacks and Exploits is 35 percent of PT0-003; objective 4.9 is Explain common attacks against specialized systems — name the mobile or AI type, not a jailbreak cookbook.
Information disclosure is secrets in backups, logs, or insecure local storage; permission abuse is over-granted camera, microphone, or storage on a stock or managed device.
Jailbreak (iOS) and rooting (Android) increase attack surface and may void MDM compliance; the exam wants that identification, not a hardware-exploit recipe.
Prompt injection is user content that changes model instructions; model manipulation is poisoning, adversarial inputs, and extracting system prompts or training data — AI is in scope only if listed.
MobSF is static and dynamic APK/IPA analysis; Frida is runtime hooking; Drozer is Android IPC; ADB is the device bridge for logcat, pulls, and installs.
Last updated: August 2026
Domain 4, Attacks and Exploits , is 35 percent of CompTIA PenTest+ PT0-003. Objective 4.9 — Explain common attacks against specialized systems — is an explain item family, not a jailbreak cookbook and not an AI exploit kit. You already scoped a mobile assessment on objective 1.1 and may have run a mobile scan on 3.1. 4.9 asks you to name the attack type that matches the evidence, then the tool family that belongs. This section covers mobile attacks ( information disclosure , jailbreak/rooting , permission abuse ) and AI attacks ( prompt injection , model manipulation ), plus the mobile-side tools: MobSF , Frida , Drozer , and Android Debug Bridge (ADB) . Operational technology, NFC, RFID, Bluetooth, Scapy, tcprelay, Wireshark/tcpdump, and Bluestrike wait for the next section. Domain 4 is not Domain 3: a MobSF row that mentions a backup flag is a hypothesis until you classify it as information disclosure. It is also not 4.5 cross-site scripting just because the interesting string is text.
Information disclosure: backups, logs, and insecure storage
Information disclosure on mobile is data leaving the app that should have stayed private. CompTIA wants the class , not a forensic dump of every path on disk.
Typical pictures:
Backups. Android allowBackup (or an ADB or cloud backup) that includes session tokens; an iOS backup that holds material the app stored poorly; a laptop image of an emulator.
Logs. Logcat or unified logs that print bearer tokens, password-reset codes, or government ID numbers.
Insecure storage. Cleartext SharedPreferences, unencrypted SQLite, world-readable files on external storage, screenshot caches of a banking screen, or clipboard contents another app can read.
When you pick it: the stem shows a secret in a backup, a log line, or a local store — not a jailbreak, and not a camera permission a flashlight never needed. Exam trap: calling every leaked string XSS . XSS is 4.5 in the browser . Mobile disclosure is the app or OS handing data to backup, logs, or storage. Trap two: treating disclosure as only a 3.1 secrets-scan trophy. 3.1 discovered it. 4.9 names the mobile attack type. Trap three: waiting for a rooted device before you will call a cleartext token a finding. Stock devices still back up and still log.
Jailbreak/rooting: more surface, and MDM may void
Jailbreak (iOS) and rooting (Android) bypass the vendor sandbox so unsigned code, remounted system partitions, and cross-app inspection become possible. PT0-003 scores what that does to the attack surface , not a hardware-exploit recipe. This guide will not give one.
What it does. Other apps and the tester can read what the sandbox used to hide. Debugging interfaces open. Integrity checks fail. Mobile device management (MDM) often voids compliance or refuses enrollment: a rooted corporate phone is a policy incident as well as a technical finding. A tester who roots a production MDM device without the rules of engagement (RoE) has expanded scope, not demonstrated cleverness.
When you pick it: the stem is a device that is already jailbroken or rooted, an MDM control that failed because of a jailbreak, or an app that assumed the sandbox still existed. When you do not: a permission the user granted in Settings ( permission abuse ) or a token in a backup of a stock device ( information disclosure ). Exam trap: treating jailbreak as the only way to find mobile issues. MobSF can flag insecure storage on a non-rooted emulator. Trap two: writing a jailbreak how-to as if the exam scored steps. Identification of increased surface and MDM impact is enough.
Permission abuse: camera, microphone, and storage
Permission abuse is an app that requested — or a user that granted — more access than the feature needs: camera , microphone , storage/photos , location, contacts, or SMS. The attack is using that grant , not crashing the kernel.
When you pick it: a PDF reader that wants the microphone, a game that reads SMS, or an app that keeps the camera after the feature closed. When you do not: a backup of tokens (disclosure) or a rooted device (jailbreak/rooting). OWASP MASVS from objective 1.3 still describes what to verify on mobile apps; 4.9 names the attack when those controls fail. A 3.1 mobile scan may have listed the permission; 4.9 is the attack-type label.
Exam trap: calling every Android permission a jailbreak. Permissions exist on stock devices. Trap two: treating permission abuse as 4.8 social engineering because a user tapped Allow. The tap is delivery. The 4.9 finding is the over-broad request or the grant nobody reviewed.
AI attacks: prompt injection and model manipulation
PT0-003 newly emphasizes artificial intelligence (AI) . Treat AI features as another attack surface in scope if listed — a chatbot, a copilot in the CRM, a model API the mobile app calls. They are not automatically in scope because the company uses AI somewhere. Shared-responsibility and third-party rules from 1.1 still bind: do not pentest the foundation-model vendor unless the RoE named that vendor.
Prompt injection is user content that changes the model's instructions . Direct injection is in the chat box. Indirect injection lives in a document, ticket, email, or webpage the model retrieves. Identification: the model did something the developer did not intend because untrusted text was treated as instructions — for example a support ticket that says to ignore policy and dump the hidden system prompt, or a retrieved page that tells the assistant to call a tool the user never asked for.
When you pick it: a chatbot followed attacker-supplied instructions, a retrieved file overrode the system prompt, or the model took an action (email, tool call) because untrusted content told it to. When you do not: poisoned training data from a past fine-tune — that is model manipulation .
Model manipulation changes the model itself or extracts what it was not supposed to reveal: poisoning (training or fine-tune data that plants a backdoor), adversarial inputs (crafted examples that flip a classification), and extracting system prompts or training data conceptually. You do not need a research paper. You need the names.
When you pick it: a poisoned fine-tune, an adversarial sample the model mislabels, or a tester extracting the hidden system prompt or memorized training snippets. Exam trap: calling every AI finding prompt injection. If the model was retrained on attacker data, that is manipulation. If the live prompt was hijacked by user text, that is injection. Trap two: treating AI as 4.5 SQL injection because both involve injection. SQLi abuses a database interpreter. Prompt injection abuses an instruction-following model . Trap three: attacking the hosted-model vendor because the customer calls an API. That is a 1.1 third-party conversation unless separately authorized.
Mobile tools: MobSF, Frida, Drozer, ADB
MobSF (Mobile Security Framework) performs static and dynamic analysis of Android and iOS packages: permissions, hardcoded secrets, backup flags, cryptography, and a runtime report when the app runs. When you pick it: the stem wants a mobile app assessment framework that can inspect an APK or IPA before (or without) hooking live functions.
Frida is runtime hooking / dynamic instrumentation. You attach to a running process and intercept function calls — conceptually tracing a decrypt routine or watching disk writes. When you pick it: the stem is hook this function at runtime. Exam trap: answering Frida for a static APK permission list — that is MobSF.
Drozer is the named Android IPC (inter-process communication) tool: exported activities, content providers, broadcast receivers, and services. When you pick it: an exported content provider that leaks a database, or an activity any app on the device can start. It is not an iOS tool.
ADB is the device bridge : install packages, pull files, view logcat, run a backup, open a shell. When you pick it: logcat, pulling files from a debug or authorized rooted build, or installing the test APK. Exam trap: treating ADB as Frida. ADB moves files and shells; Frida hooks functions.
Scapy, tcprelay, Wireshark/tcpdump, and Bluestrike belong in 17.2.
Attack or tool What it does When you pick it Exam trap
Information disclosure Backups, logs, or insecure storage leak secrets Token in backup or logcat Not XSS; not jailbreak-only
Jailbreak/rooting Breaks the sandbox; may void MDM Device is rooted or jailbroken; MDM failed Not a how-to; not the only mobile finding
Permission abuse Over-granted camera, microphone, or storage Flashlight wants the microphone Not a jailbreak
Prompt injection User content changes model instructions Chatbot followed a ticket's hidden instruction Not training-data poison
Model manipulation Poisoning, adversarial inputs, prompt or training extraction Fine-tune poison or extracted system prompt Not 4.5 SQLi
- MobSF Static and dynamic mobile app analysis APK or IPA assessment framework Not Drozer IPC
- Frida Runtime hooking Intercept a live function Not a static permission dump
- Drozer Android IPC Exported provider or activity Not iOS
- ADB Device bridge logcat, pull, install Not Frida
- Worked mobile and AI estate
An in-scope Android app plus an in-scope support chatbot. MobSF flags allowBackup=true and a cleartext SharedPreferences token — information disclosure . The same app requests the microphone although it is a PDF reader — permission abuse . A tester device is rooted, so MDM marks it non-compliant and other apps can read the sandbox — jailbreak/rooting , not a license to skip RoE. Frida hooks the local crypto function; Drozer shows an exported content provider; ADB pull and logcat collect the evidence. The chatbot follows a customer ticket that says to ignore policy and print the system prompt — prompt injection . A separate fine-tune set included attacker-labeled examples that created a backdoor phrase — model manipulation . None of these is a Modbus write. Name the 4.9 type first.