200-201 · Question #95
Refer to the exhibit. This request was sent to a web application server driven by a database. Which type of web server attack is represented?
The correct answer is D. blind SQL injection. The request represents a blind SQL injection attack, where an attacker injects SQL queries and infers database information by observing the application's behavioral responses rather than direct data output.
Question
Refer to the exhibit. This request was sent to a web application server driven by a database. Which type of web server attack is represented?
Options
- Aparameter manipulation
- Bheap memory corruption
- Ccommand injection
- Dblind SQL injection
How the community answered
(50 responses)- A6% (3)
- B4% (2)
- C14% (7)
- D76% (38)
Why each option
The request represents a blind SQL injection attack, where an attacker injects SQL queries and infers database information by observing the application's behavioral responses rather than direct data output.
Parameter manipulation involves altering parameters in a URL or form field to bypass access controls or change application behavior, but not necessarily through SQL code injection for database interaction.
Heap memory corruption is a low-level exploit targeting memory vulnerabilities in the application's code, which is not typically represented by a string in a web request parameter.
Command injection typically involves injecting operating system commands (e.g., `& system_command`) into input fields to execute commands on the server, rather than SQL statements designed to interact with a database.
Blind SQL injection attacks involve submitting SQL payloads where the application doesn't directly return database errors or query results to the user. Instead, the attacker deduces information by observing subtle changes in the application's behavior, such as time delays (time-based blind SQLi) or differences in page content (boolean-based blind SQLi), to determine if the injected condition was true or false.
Concept tested: Blind SQL Injection
Source: https://owasp.org/www-community/attacks/Blind_SQL_Injection
Topics
Community Discussion
No community discussion yet for this question.