are tasked to exploit the web application and fetch the user data. Identify the contact number (Contact) of a user, Steve, in the moviescope database. Note: You already have an account on the web…

Question

Options

• A1-202-509-7316
• B1-202-509-7432
• C01-202-509-7364
• D1-202-509-8421

• A
  83% (35)
• B
  5% (2)
• C
  10% (4)
• D
  2% (1)

Explanation

SQL Injection Attack on MovieScope Database

Option A (1-202-509-7316) is correct because when exploiting the web application using SQL injection with the credentials sam/test, querying the moviescope database for user "Steve" returns this specific contact number from the users table. This is a classic SQL injection practical where you manipulate input fields (such as login or search forms) to extract unauthorized data using payloads like ' OR '1'='1 or UNION-based injection to dump table contents.

Options B, C, and D are distractors with slightly altered digits - B changes the last four digits to 7432, C adds a leading zero making it non-standard U.S. format (01-202-509-7364), and D uses 8421 as the suffix - none of which match the actual database record for Steve in the MovieScope application.

Memory Tip: Remember the last four digits 7316 by associating it with a sequence - think "73rd year, 16th amendment" or simply note that among the choices, only Option A follows a standard U.S. phone format and matches what SQL injection retrieves from Steve's record. When practicing, run a UNION SELECT attack targeting the contact column to verify the result firsthand.

No community discussion yet for this question.