A Chief Information Security Officer wants to evaluate the security of the company's e-commerce application. Which of the following tools should a penetration tester use FIRST to obtain relevant…

The correct answer is C. w3af. w3af (Web Application Attack and Audit Framework) is the best first tool because it supports passive crawling and audit modes that can map the application's structure and identify potential vulnerabilities with minimal noise. The question emphasizes 'FIRST' and 'without…

Information Gathering and Vulnerability Scanning

Question

A Chief Information Security Officer wants to evaluate the security of the company's e-commerce application. Which of the following tools should a penetration tester use FIRST to obtain relevant information from the application without triggering alarms?

Options

ASQLmap
BDirBuster
Cw3af
DOWASP ZAP

How the community answered

(49 responses)

A
6% (3)
B
2% (1)
C
82% (40)
D
10% (5)

Explanation

w3af (Web Application Attack and Audit Framework) is the best first tool because it supports passive crawling and audit modes that can map the application's structure and identify potential vulnerabilities with minimal noise. The question emphasizes 'FIRST' and 'without triggering alarms,' pointing to passive/low-noise reconnaissance. SQLmap (A) actively injects payloads into parameters and would immediately trigger WAF and IDS alerts. DirBuster (B) brute-forces directories with many rapid requests, easily detected. OWASP ZAP (D) has a passive mode but is more commonly used as an active scanning proxy, and w3af's audit-first approach is more appropriate for initial stealthy assessment.

Topics

#Web application security#Information gathering#Penetration testing tools#Reconnaissance

Community Discussion

No community discussion yet for this question.

Full PT0-002 Practice