CAS-002 · Question #584
Company XYZ has purchased and is now deploying a new HTML5 application. The company wants to hire a penetration tester to evaluate the security of the client and server components of the proprietary…
The correct answer is C. Local proxy D. Fuzzer. Black box testing provides no access to source code or internal architecture, so testers rely on tools that interact with the running application externally. A local proxy and fuzzer are the standard black-box tools for web application security assessment.
Question
Company XYZ has purchased and is now deploying a new HTML5 application. The company wants to hire a penetration tester to evaluate the security of the client and server components of the proprietary web application before launch. Which of the following is the penetration tester MOST likely to use while performing black box testing of the security of the company's purchased application? (Select TWO).
Options
- ACode review
- BSandbox
- CLocal proxy
- DFuzzer
- EWeb vulnerability scanner
How the community answered
(27 responses)- A11% (3)
- B7% (2)
- C78% (21)
- E4% (1)
Why each option
Black box testing provides no access to source code or internal architecture, so testers rely on tools that interact with the running application externally. A local proxy and fuzzer are the standard black-box tools for web application security assessment.
Code review requires access to the application's source code, which is not available during black box testing.
A sandbox is used to safely execute and analyze potentially malicious files or malware, not to test web application security.
A local proxy (such as Burp Suite or OWASP ZAP) sits between the tester's browser and the web server, allowing interception, inspection, and manipulation of HTTP/HTTPS requests and responses without requiring any source code access.
A fuzzer automatically sends large volumes of malformed, random, or unexpected inputs to the application's inputs and API endpoints to uncover crashes, errors, and vulnerabilities - all without needing internal code knowledge.
A web vulnerability scanner is an automated tool that can be used in black box testing, but it is less targeted and precise than the combination of a local proxy and fuzzer for evaluating specific client and server component interactions.
Concept tested: Black box web application penetration testing tools
Source: https://owasp.org/www-project-web-security-testing-guide/
Topics
Community Discussion
No community discussion yet for this question.