Which flaw types are commonly discovered by web application vulnerability scanners such as Burp Suite?

• A. Firewall misconfigurations
• B. Data leakage via backups
• C. Cross-Site Scripting and SQL Injection
• D. Physical tampering

Answer: (C)

The key idea is that web application vulnerability scanners focus on flaws in how a web app handles input and processes data, especially issues that allow attackers to run unintended code or access data through the app’s interfaces. Cross-Site Scripting and SQL Injection are classic examples of these flaws. A scanner like Burp Suite automatically sends crafted inputs through forms, query strings, cookies, and other parameters, then analyzes the server’s responses to see if user-supplied data is executed as code (XSS) or misused in SQL queries (SQL injection). These are common, detectable weaknesses that arise from improper input validation, output encoding, or query construction, and they’re precisely the types of issues a web app scanner is designed to uncover.

In contrast, firewall misconfigurations are infrastructure-level or network perimeter issues, data leakage via backups relates to data governance and backup security, and physical tampering involves the physical security of hardware. These require different assessment methods beyond the scope of a web application vulnerability scan, so they aren’t the typical findings of a tool focused on testing the web app itself.