An online shopping site restricts the quantity of an item each customer can order. The site generates the following code when the customer clicks the submit button. However, customers are still able…

Question

Exhibit

Options

• AHTTP interceptor
• BVulnerability scanner
• CFuzzer
• DExploit framework

• A
  3% (1)
• B
  13% (5)
• C
  77% (30)
• D
  8% (3)

Explanation

A fuzzer systematically sends a wide range of unexpected, boundary, and out-of-range input values to a target application to uncover missing or inadequate validation. In this scenario, if customers can order more than three items despite a client-side restriction, it indicates the quantity field likely lacks server-side validation. A fuzzer would automatically test quantities of 4, 100, -1, 0, and other edge cases to confirm the server accepts them, documenting the full scope of the vulnerability. An HTTP interceptor (A) could also be used to manually modify a single request - and is a common investigation tool for this type of issue - but a fuzzer provides broader, systematic coverage of boundary conditions. A vulnerability scanner (B) looks for known CVEs, not missing business logic validation. An exploit framework (D) is used to leverage known vulnerabilities, not investigate application logic flaws.

No community discussion yet for this question.