312-50V13 · Question #239
Daniel Is a professional hacker who Is attempting to perform an SQL injection attack on a target Injection attempts based on predefined signatures. To evade any comparison statement, he attempted…
The correct answer is D. Variation. Daniel is using a variation evasion technique by altering the syntax of the SQL injection payload to bypass signature-based detection systems.
Question
Options
- ANull byte
- BIP fragmentation
- CChar encoding
- DVariation
How the community answered
(39 responses)- A3% (1)
- B5% (2)
- C8% (3)
- D85% (33)
Why each option
Daniel is using a variation evasion technique by altering the syntax of the SQL injection payload to bypass signature-based detection systems.
Null byte injection involves inserting a null character (e.g., %00) to terminate a string, often to bypass file extension checks or path validations, which is not what's described here.
IP fragmentation is a network layer technique where an IP packet is split into smaller fragments to bypass stateless firewalls or IDS, and is unrelated to SQL injection payload modification.
Character encoding involves representing characters in a different format (e.g., URL encoding, Unicode) to bypass filters, but the example given ('1'='1' vs 1=1) is a syntactical change, not merely an encoding change.
The technique described involves changing the characters in an SQL injection payload (e.g., from 'or 1=1' to 'or '1'='1') to evade detection systems that rely on predefined signatures. This is a common evasion technique called 'variation' or 'obfuscation' where the attacker modifies the attack signature while maintaining its functionality to bypass security controls like Web Application Firewalls (WAFs) or intrusion detection systems.
Concept tested: SQL injection evasion techniques
Topics
Community Discussion
No community discussion yet for this question.