Which term describes automated tools that crawl web applications and inject payloads to discover vulnerabilities such as XSS and SQLi?

• A. Vulnerability Scanning
• B. Penetration Testing
• C. Security Audit
• D. Firewall Assessment

Answer: (A)

Automated vulnerability scanning uses tools that crawl a web application, map the inputs and pages, and send crafted payloads to see how the app handles them. This approach aims to uncover weaknesses like cross-site scripting (XSS) and SQL injection (SQLi) by autonomously testing many entry points and returning a report of potential issues with risk levels. It’s fast, broad, and repeatable, making it ideal for regularly assessing many pages and parameters. However, it can produce false positives and may not fully prove exploitability, which is where manual verification in a broader testing effort becomes important.

Penetration testing, in contrast, involves a tester performing targeted, often manual attempts to exploit vulnerabilities to demonstrate real impact and access. A security audit is a broader review of policies, controls, and configurations, while a firewall assessment focuses on network perimeter protections rather than the application logic and input validation vulnerabilities.