A security engineer successfully exploits an application during a penetration test. As proof of the exploit, the security engineer takes screenshots of how data was compromised in the application…

Question

Exhibit

Options

• AThe engineer captured the data with a protocol analyzer, and then utilized Python to edit the data
• BThe engineer queried the server and edited the data using an HTTP proxy interceptor
• CThe engineer used a cross-site script sent via curl to edit the data
• DThe engineer captured the HTTP headers, and then replaced the JSON data with a banner-

• A
  6% (4)
• B
  73% (46)
• C
  5% (3)
• D
  16% (10)

Explanation

An HTTP proxy interceptor (such as Burp Suite or OWASP ZAP) is a man-in-the-middle tool that sits between the browser and the server, allowing a tester to capture, inspect, modify, and replay HTTP/HTTPS requests and responses in real time. This is the most common tool used to manipulate web application data during penetration testing - the tester can alter form fields, cookies, headers, or JSON payloads before they reach the server. Option A involves a protocol analyzer (passive capture) combined with Python scripting, which is more complex and indirect. Option C describes XSS via curl, which is a different attack vector targeting client-side execution. Option D involves manipulating HTTP headers and JSON data, but the 'banner' aspect suggests banner grabbing, which is a reconnaissance technique rather than an exploitation method.

No community discussion yet for this question.