312-50V13 Question #538: Real Exam Question with Answer & Explanation

Question

As a cybersecurity professional, you are responsible for securing a high-traffic web application that uses MySQL as its backend database. Recently, there has been a surge of unauthorized login attempts, and you suspect that a seasoned black-hat hacker is behind them. This hacker has shown proficiency in SQL Injection and appears to be using the 'UNION' SQL keyword to trick the login process into returning additional data. However, your application's security measures include filtering special characters in user inputs, a method usually effective against such attacks. In this challenging environment, if the hacker still intends to exploit this SQL Injection vulnerability, which strategy is he most likely to employ?

Options

• AThe hacker alters his approach and injects a `DROP TABLE' statement, a move that could
• BThe hacker tries to manipulate the 'UNION' keyword in such a way that it triggers a database
• CThe hacker switches tactics and resorts to a `time-based blind' SQL Injection attack, which would
• DThe hacker attempts to bypass the special character filter by encoding his malicious input, which

Explanation

Explanation

Option D is correct because when special character filtering is in place, an experienced attacker's most logical bypass technique is encoding - converting malicious SQL characters into alternative representations (such as URL encoding, hex encoding, or Unicode encoding) that evade the filter while still being interpreted as valid SQL by the database engine, allowing the UNION-based injection to proceed as intended.

Why the distractors are wrong:

• Option A (DROP TABLE) is incorrect because a destructive DDL statement would still be blocked by the same special character filter, and it doesn't align with the hacker's goal of extracting data via UNION.
• Option B (manipulating UNION to trigger a database error) doesn't logically bypass the filter - the special characters needed would still be caught, and error-based injection is a separate technique.
• Option C (time-based blind SQL injection) is a valid real-world technique, but it represents switching attacks entirely rather than persisting with UNION-based exploitation, making it less likely given the hacker's demonstrated proficiency with UNION specifically.

Memory Tip: Think of encoding as wearing a disguise - the malicious payload is still there, just dressed differently enough to fool the bouncer (filter) at the door. When filters block characters, Encoding helps Evade them. (Filters block → Encoding unlocks)

No community discussion yet for this question.