Which attack types are commonly targeted by automated web vulnerability scanners?

• A. Social Engineering and Phishing
• B. DNS Spoofing
• C. Cross-Site Scripting and SQL Injection
• D. Rogue Access Points

Answer: (C)

Automated web vulnerability scanners focus on finding weaknesses in how a web application handles user input and interacts with the database. They simulate typical attack vectors by sending crafted inputs and examining how the app responds, looking for signs of flaws that could be exploited automatically.

Cross-Site Scripting (XSS) and SQL Injection (SQLi) are classic injection-type vulnerabilities that scanners are built to detect. XSS involves injecting script code that the application reflects back to the user or stores and serves to other users, revealing why scanners test various input vectors and how outputs are encoded or sanitized. SQL Injection involves inserting malicious SQL through inputs to see if the database executes unintended commands, returns data, or alters behavior—something scanners routinely check by trying different payloads and observing errors or unexpected results. These vulnerabilities are widespread in web apps and have well-established automated detection patterns, making them primary targets for scanners.

Social engineering and phishing rely on manipulating people, not the app’s code, so scanners don’t target them. DNS spoofing and rogue access points concern network or wireless infrastructure rather than web application flaws, so they aren’t the focus of automated web vulnerability scanners.