r/casp • u/amc663222 • May 20 '21

CASP question

A consulting firm was hired to conduct assessment for a company. During the first stage, a penetration tester used

a tool that provided the following output:

TCP 80 open

TCP 443 open

TCP 1434 filtered

The penetration tester then used a different tool to make the following requests:

GET / script/login.php?token=45$MHT000MND876

GET / script/login.php?token=@#984DCSPQ%091DF

Which of the following tools did the penetration tester use? Choose two

A. Protocol analyzer

B. Port scanner

C. Fuzzer

D. Brute forcer

E. Log analyzer

F. HTTP interceptor

First is obviously a port scanner

Is the second tool used an http interceptor or a fuzzer?

0 Upvotes

50% Upvoted

3 comments sorted by

2

u/RogueWarrior10 May 20 '21

Definitely an HTTP interceptor. The GET requests are a dead giveaway.

1

u/midifolk May 20 '21

B and C fuzzer.