CAS-002 · Question #668
A security manager has provided a Statement of Work (SOW) to an external penetration testing firm for a web application security test. The web application starts with a very simple HTML survey form…
The correct answer is A. HTTP interceptor. An HTTP interceptor is the best tool for testing a web form's input validation using predefined test cases because it allows the tester to manually intercept and precisely modify HTTP requests before they reach the server.
Question
A security manager has provided a Statement of Work (SOW) to an external penetration testing firm for a web application security test. The web application starts with a very simple HTML survey form with two components: a country selection dropdown list and a submit button. The penetration testers are required to provide their test cases for this survey form in advance. In order to adequately test the input validation of the survey form, which of the following tools would be the BEST tool for the technician to use?
Options
- AHTTP interceptor
- BVulnerability scanner
- CPort scanner
- DFuzzer
How the community answered
(25 responses)- A84% (21)
- B4% (1)
- D12% (3)
Why each option
An HTTP interceptor is the best tool for testing a web form's input validation using predefined test cases because it allows the tester to manually intercept and precisely modify HTTP requests before they reach the server.
An HTTP interceptor such as Burp Suite or OWASP ZAP sits between the browser and web server, letting the tester capture, modify, and replay specific HTTP requests with controlled payloads. Because the testers must supply documented test cases in advance, this tool provides the precise per-request control needed to submit specific values to the form's country dropdown and verify how server-side input validation responds.
A vulnerability scanner performs automated broad-based scanning across many checks and cannot be easily pre-configured with specific, predetermined test cases targeting a single form element.
A port scanner identifies open network ports and services on a host and does not interact with application-layer form inputs or HTTP request content at all.
A fuzzer generates large volumes of random or semi-random inputs automatically, which conflicts with the requirement to supply specific, pre-documented test cases before testing begins.
Concept tested: HTTP interceptor for web form input validation testing
Source: https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/
Topics
Community Discussion
No community discussion yet for this question.