312-50V12 Question #153: Real Exam Question with Answer & Explanation

Question

As a cybersecurity professional, you are responsible for securing a high-traffic web application that uses MySQL as its backend database. Recently, there has been a surge of unauthorized login attempts, and you suspect that a seasoned black-hat hacker is behind them. This hacker has shown proficiency in SQL Injection and appears to be using the 'UNION' SQL keyword to trick the login process into returning additional data. However, your application's security measures include filtering special characters in user inputs, a method usually effective against such attacks. In this challenging environment, if the hacker still intends to exploit this SQL Injection vulnerability, which strategy is he most likely to employ?

Options

• AThe hacker tries to manipulate the 'UNION' keyword in such a way that it triggers a database
• BThe hacker switches tactics and resorts to a 'time-based blind' SQL Injection attack, which would
• CThe hacker attempts to bypass the special character filter by encoding his malicious input, which
• DThe hacker alters his approach and injects a DROP TABLE' statement, a move that could

Explanation

Despite character filtering hindering UNION-based SQL injection, a seasoned hacker is most likely to switch to a time-based blind SQL Injection attack to continue exploiting the vulnerability.

Common mistakes.

• A. If character filtering is effective against SQL Injection, merely 'manipulating' the 'UNION' keyword is unlikely to bypass the filter and will still prevent successful data retrieval.
• C. While encoding is a common technique to bypass character filters, the question implies the existing filtering is effective, suggesting that encoding attempts for direct data retrieval methods like UNION have either failed or are not the most effective next step when dealing with no visible output.
• D. Injecting a 'DROP TABLE' statement is a destructive action aimed at data deletion, not at 'returning additional data' through the login process, and would still be subject to the same character filtering that prevents UNION-based attacks.

Concept tested. SQL Injection bypass techniques (blind injection)

Reference. https://learn.microsoft.com/en-us/azure/security/fundamentals/sql-injection#blind-sql-injection-time-based

No community discussion yet for this question.