Daniel Is a professional hacker who Is attempting to perform an SQL injection attack on a target Injection attempts based on predefined signatures. To evade any comparison statement, he attempted…

Question

Options

• ANull byte
• BIP fragmentation
• CChar encoding
• DVariation

• A
  4% (2)
• B
  9% (4)
• C
  2% (1)
• D
  84% (38)

Explanation

One may append the comment "-" operator along with the String for the username and whole avoid executing the password segment of the SQL query. Everything when the -- operator would be considered as comment and not dead. To launch such an attack, the value passed for name could be 'OR 1'=1' ; -- Statement = "SELECT * FROM CustomerDB' WHERE name' = "+ userName + " AND password' = " + passwd + " ; " Statement = "SELECT * FROMCustomerDB' WHERE name' = ' OR 1'=1;- + " AND password' = " + passwd + " ` ; " All the records from the customer database would be listed. Yet, another variation of the SQL Injection Attack can be conducted in dbms systems that allow multiple SQL injection statements. Here, we will also create use of the vulnerability in sure dbms whereby a user provided field isn't strongly used in or isn't checked for sort constraints. This could take place once a numeric field is to be employed in a SQL statement; but, the programmer makes no checks to validate that the user supplied input is numeric.

No community discussion yet for this question.