312-50V11 · Question #1025
What is the following command used for?
The correct answer is B. A Enumerating the databases in the DBMS for the URL. The command shown (likely sqlmap with a --dbs flag) is used to enumerate and list all database names present in the DBMS at the target URL.
Question
Options
- ACreating backdoors using SQL injection
- BA Enumerating the databases in the DBMS for the URL
- CRetrieving SQL statements being executed on the database
- DSearching database statements at the IP address given
How the community answered
(53 responses)- A2% (1)
- B94% (50)
- D4% (2)
Why each option
The command shown (likely sqlmap with a --dbs flag) is used to enumerate and list all database names present in the DBMS at the target URL.
Creating backdoors via SQL injection requires injecting persistent malicious objects such as stored procedures or web shells, not a read-only database enumeration command.
SQL injection enumeration tools such as sqlmap query DBMS metadata schemas (for example, information_schema.schemata in MySQL) when given a target URL, returning the names of all accessible databases hosted by that DBMS. This technique identifies the database landscape as a reconnaissance step before targeting specific tables or data.
Retrieving SQL statements currently executing on the database requires server-side audit logging or monitoring views (e.g., pg_stat_activity), not an external injection enumeration tool.
The command targets a web application URL endpoint rather than a raw IP address, and its purpose is to list database names rather than search the content of SQL statements.
Concept tested: DBMS database enumeration using sqlmap
Source: https://github.com/sqlmapproject/sqlmap/wiki/Usage
Topics
Community Discussion
No community discussion yet for this question.