nerdexam
EC-Council

312-50V12 · Question #273

What is the following command used for?

The correct answer is C. Enumerating the databases in the DBMS for the URL. The command is used to identify and list all available databases within a Database Management System (DBMS) that a web application, specified by its URL, interacts with.

Submitted by carlos_mx· Mar 4, 2026Web Application Hacking

Question

What is the following command used for?

Options

  • ARetrieving SQL statements being executed on the database
  • BCreating backdoors using SQL injection
  • CEnumerating the databases in the DBMS for the URL
  • DSearching database statements at the IP address given

How the community answered

(31 responses)
  • B
    6% (2)
  • C
    90% (28)
  • D
    3% (1)

Why each option

The command is used to identify and list all available databases within a Database Management System (DBMS) that a web application, specified by its URL, interacts with.

ARetrieving SQL statements being executed on the database

While SQL injection can sometimes reveal query information, the specific function of this command, aligned with database enumeration, is to list database names, not to retrieve currently executing SQL statements.

BCreating backdoors using SQL injection

This command serves as an information gathering step (enumeration) to map the database structure, rather than directly creating backdoors, although enumeration can be a prerequisite for such malicious actions.

CEnumerating the databases in the DBMS for the URLCorrect

This command, typically a SQL injection payload or a feature within an automated SQL injection tool, is designed to exploit vulnerabilities in a web application's input to query the underlying database system. Its purpose is to enumerate and retrieve the names of all accessible databases by leveraging system tables like `information_schema.schemata` or similar views within the DBMS.

DSearching database statements at the IP address given

The command specifically targets a URL, indicating a web application context, and its primary function is database enumeration within a DBMS, not a general search for statements at an arbitrary IP address.

Concept tested: SQL Injection Database Enumeration

Source: https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/07-Input_Validation_Testing/05-Testing_for_SQL_Injection

Topics

#SQL injection#database enumeration#DBMS#URL hacking

Community Discussion

No community discussion yet for this question.

Full 312-50V12 Practice