A malicious user was able to export an entire website's user database by entering specific commands into a field on the company's website. Which of the following did the malicious user most likely…

Cross-site scripting (XSS) involves injecting malicious scripts into web pages viewed by other users, primarily for stealing cookies or defacing sites, not for directly exporting databases from the backend.

SQL injection occurs when an attacker inserts malicious SQL code into input fields on a web application, which is then executed by the backend database. This allows the attacker to bypass authentication, retrieve sensitive data like user databases, or even modify/delete database contents.

A brute-force attack involves systematically trying many combinations of passwords or passphrases to guess credentials, not entering commands into a field to extract a database directly.

A Distributed Denial of Service (DDoS) attack aims to disrupt service by overwhelming a system with traffic, not to extract data from a database.