CompTIA PenTest+ Practice Test

What does Wapiti do as a vulnerability scanner?

1. Analyzes the source code of an application

2. Automatically navigates a web application looking for injection points

3. Performs network penetration testing

4. Generates reports on system vulnerabilities

The correct answer is: Automatically navigates a web application looking for injection points

Wapiti is a web application vulnerability scanner that is primarily designed to automatically navigate through a website to identify potential security weaknesses, especially focusing on finding injection points such as SQL injection and cross-site scripting. It works by crawling the web application, analyzing the input fields, and testing for various types of vulnerabilities that could be exploited by attackers. The other options, while related to security and vulnerability assessment, do not accurately describe Wapiti's functionality. For example, analyzing the source code of an application is a task typically performed by static analysis tools rather than Wapiti, which relies on dynamic testing methods. Performing network penetration testing generally involves broader techniques and tools that assess network devices, configurations, and general network topology, which is outside the scope of Wapiti's web application focus. Finally, while Wapiti does generate reports after scanning, its primary function is to identify vulnerabilities through the automated navigation of web applications rather than simply reporting on existing vulnerabilities in systems. Therefore, automatic navigation and discovery of injection points is the most accurate description of Wapiti's role as a vulnerability scanner.