An audit at a popular on-line shopping site reveals that a flaw in the website allows customers to purchase goods at a discounted rate. To improve security the Chief Information Security Officer…

Blackbox testing is a methodology, not a tool, and fingerprinting identifies software versions rather than testing runtime input validation logic.

Code review is a static analysis technique and a packet analyzer passively captures traffic - neither directly exercises or tests input validation behavior in a running web application.

A fuzzer automatically generates malformed, boundary, and unexpected input values to test whether the application properly validates data in both free-form text fields and drop-down selections. An HTTP interceptor such as Burp Suite allows the tester to intercept and modify HTTP requests mid-transit, enabling manipulation of POST parameters that represent drop-down values and exposing missing server-side validation that permitted the discounted purchase exploit.

An enumerator discovers accounts and resources while a vulnerability scanner identifies known CVEs - neither specifically targets input validation flaws in application form fields.