Joe, a penetration tester, is tasked with testing the security robustness of the protocol between a mobile web application and a RESTful application server. Which of the following security tools…

A jailbroken device is useful for analyzing the mobile app binary or bypassing certificate pinning, but it is not specifically required to assess the protocol security between the mobile app and the RESTful server.

Reconnaissance tools are used for passive or active information gathering about a target environment and are not directly used to analyze or test the security of an active protocol communication channel.

A network enumerator identifies hosts, open ports, and services on a network but does not analyze application-layer protocol security or the content of REST API communications.

An HTTP interceptor (such as Burp Suite or OWASP ZAP) is essential for a mobile-to-REST server assessment because it acts as a proxy to capture, inspect, and manipulate HTTP/HTTPS requests and responses between the mobile application and the server, allowing the tester to analyze authentication tokens, session management, and data exposure in transit.

A vulnerability scanner complements the HTTP interceptor by systematically identifying known vulnerabilities in the RESTful application such as injection flaws, misconfigurations, and insecure endpoints, providing broader coverage than manual testing alone.

Password crackers test the strength of authentication credentials and are not relevant to assessing the security of the protocol or data transmission between a mobile app and a REST API server.