Which tool was identified in the capture?

• A. TLS
• B. Wfuzz
• C. Log4j
• D. JNDI

Answer: (B)

Recognizing automated web fuzzing activity in a capture. This kind of tool is built to probe a web application by systematically trying many inputs and endpoints to uncover weaknesses. If you look at the traffic, you’ll often see a flood of HTTP requests to lots of different URLs and parameters, with similar structures but varying values. The payloads are crafted to test how inputs are handled—checking for injection points, validation gaps, and other vulnerabilities—so the pattern looks like scripted automation rather than a human typing requests by hand. A telling hint is a user-agent or request signatures that point to a fuzzing tool, or a consistent cadence of requests that mirrors a fuzzing workflow across directories, parameters, or common payloads.

TLS traffic, by contrast, would mostly show encrypted handshakes with little readable content. Logs or exploit strings tied to Log4j would appear as Java logging activity or specific exploit payloads referencing log4j, not as broad fuzzing behavior. JNDI activity would suggest directory/service lookups rather than broad input probing. The combination of widespread, parameterized requests with potential fuzzing-era signatures points to a web fuzzing tool such as Wfuzz.