nerdexam
EC-Council

312-50V10 · Question #315

Which tool is used to automate SQL injections and exploit a database by forcing a given web application to connect to another database controlled by a hacker?

The correct answer is A. DataThief. DataThief is a tool designed to automate SQL injection attacks and can force a web application to connect to an attacker-controlled database for data exfiltration.

SQL Injection

Question

Which tool is used to automate SQL injections and exploit a database by forcing a given web application to connect to another database controlled by a hacker?

Options

  • ADataThief
  • BNetCat
  • CCain and Abel
  • DSQLInjector

How the community answered

(34 responses)
  • A
    94% (32)
  • B
    3% (1)
  • D
    3% (1)

Why each option

DataThief is a tool designed to automate SQL injection attacks and can force a web application to connect to an attacker-controlled database for data exfiltration.

ADataThiefCorrect

DataThief is specifically designed to automate SQL injection exploitation, including the ability to force a target web application to establish connections to a database controlled by the attacker. It targets SQL Server's xp_cmdshell and linked server features to pivot from the victim database to attacker-controlled infrastructure.

BNetCat

NetCat is a general-purpose network utility for reading and writing data across network connections, not a SQL injection automation tool.

CCain and Abel

Cain and Abel is a password recovery and network sniffing tool focused on credential cracking, not SQL injection exploitation.

DSQLInjector

SQLInjector is not a widely recognized or standard tool in the SQL injection exploitation category and does not match the described capability.

Concept tested: SQL injection automation tools and database exploitation

Source: https://owasp.org/www-community/attacks/SQL_Injection

Topics

#SQL injection#DataThief#database exploitation#automated tools

Community Discussion

No community discussion yet for this question.

Full 312-50V10 Practice