During user acceptance testing, the security administrator believes to have discovered an issue in the login prompt of the company's financial system. While entering the username and password, the…

Question

Options

• AThe administrator should enter a username and use an offline password cracker in brute
• BThe administrator should use a network analyzer to determine which packet caused the
• CThe administrator should extract the password file and run an online password cracker in
• DThe administrator should run an online fuzzer against the login screen.

• A
  9% (3)
• B
  6% (2)
• C
  3% (1)
• D
  81% (26)

Explanation

The described behavior - a program crashing and dropping to a system command prompt when unexpected input is entered - is a classic symptom of an input validation vulnerability, potentially a buffer overflow or injection flaw. The administrator suspects a mistyped input triggered the crash and wants to systematically reproduce it. Fuzzing (D) is the correct technique: an online fuzzer sends a large volume of random, malformed, boundary-value, and unexpected inputs to the login interface to systematically identify which input causes the crash. This is exactly the purpose of fuzzing tools in security testing. Answer A (offline password cracker) targets password hashes, not input validation. Answer B (network analyzer) captures traffic but does not generate test inputs. Answer C (extracting password file and using an online cracker) is irrelevant to reproducing a crash.

No community discussion yet for this question.