An internal penetration tester finds a legacy application that takes measurement input made in a text box and outputs a specific string of text related to industry requirements. There is no…

Question

Options

• ARunning an automated fuzzer
• BConstructing a known cipher text attack
• CAttempting SQL injection commands
• DPerforming a full packet capture
• EUsing the application in a malware sandbox

• A
  74% (20)
• B
  4% (1)
• C
  7% (2)
• D
  4% (1)
• E
  11% (3)

Explanation

This is a black-box reverse engineering scenario: no source code, no documentation, and the only way to understand the application is by probing it. An automated fuzzer systematically sends a wide variety of inputs - including edge cases, malformed data, and boundary values - and observes the resulting outputs. This empirical input/output mapping is exactly what is needed to understand how the legacy application behaves. SQL injection tests for a specific vulnerability, not general behavior. A known ciphertext attack is a cryptographic technique unrelated to this scenario. Full packet capture reveals network traffic, not application logic. A malware sandbox is designed for dynamic malware analysis, not general application behavior mapping.

No community discussion yet for this question.