CompTIA PenTest+ Practice Test

Which tool is a web application vulnerability scanner that automatically navigates to identify injection points?

1. Burp Suite

2. Wapiti

3. Nikto

4. OWASP ZAP

The correct answer is: Wapiti

The correct choice is a web application vulnerability scanner designed to automatically navigate and identify injection points within web applications. This type of tool is essential for penetration testers as it helps streamline the testing process by automatically searching for vulnerabilities such as SQL injection, Cross-Site Scripting (XSS), and other common web app security flaws. Specifically, Wapiti is known for its ability to perform a wide range of automated scans. It uses a black box approach, meaning it tests the application without accessing the source code and can map the application's structure while looking for potential injection points. This capability makes it particularly effective for identifying vulnerabilities that could be exploited by an attacker. Other tools mentioned in the options have different focuses or methodologies. Burp Suite, for instance, is a comprehensive platform that includes a variety of tools for web security testing, but it requires more manual intervention and user input during scanning. Nikto is primarily a web server scanner that focuses on identifying vulnerabilities in the server itself rather than the application layer. OWASP ZAP is similar to Burp Suite in that it offers various tools for penetration testing and can automate certain aspects, but it is generally regarded as more user-friendly and suited for a broader range of users, including those without extensive background in security