In the context of testing an FTP server, what is the first step in fuzzing to identify potential vulnerabilities?

• A. Perform a DNS lookup.
• B. Use Scapy to send crafted or malformed inputs to the FTP server.
• C. Repair server firmware.
• D. Use a standard login script.

Answer: (B)

Fuzzing tests how a service handles unexpected inputs by feeding crafted or malformed data and watching for crashes, hangs, or abnormal responses. For an FTP server, the first step is to send crafted or malformed FTP commands or packets to provoke unusual behavior and reveal weaknesses. A tool like Scapy is well suited here because it lets you build and transmit custom protocol packets, enabling systematic fuzzing of the FTP command set and response handling. DNS lookups are about resolving addresses and do not exercise the server’s input handling. Repairing server firmware is a maintenance activity and not part of testing fuzzing. A standard login script checks authentication, not how the server handles unexpected data, so it doesn't serve as the initial fuzzing step.