350-701 · Question #173
An organization has two machines hosting web applications. Machine 1 is vulnerable to SQL injection while machine 2 is vulnerable to buffer overflows. What action would allow the attacker to gain…
The correct answer is D. inserting malicious commands into the database. To gain access to Machine 1, which is vulnerable to SQL injection, an attacker would exploit its specific vulnerability by inserting malicious commands into its database, while this action would not affect Machine 2.
Question
An organization has two machines hosting web applications. Machine 1 is vulnerable to SQL injection while machine 2 is vulnerable to buffer overflows. What action would allow the attacker to gain access to machine 1 but not machine 2?
Options
- Asniffing the packets between the two hosts
- Bsending continuous pings
- Coverflowing the buffer's memory
- Dinserting malicious commands into the database
How the community answered
(48 responses)- A4% (2)
- B2% (1)
- C13% (6)
- D81% (39)
Why each option
To gain access to Machine 1, which is vulnerable to SQL injection, an attacker would exploit its specific vulnerability by inserting malicious commands into its database, while this action would not affect Machine 2.
Sniffing packets is a passive reconnaissance technique that captures data in transit and does not directly exploit a SQL injection vulnerability to gain access.
Sending continuous pings is a denial-of-service technique or for network reachability testing, not an exploit for SQL injection or buffer overflows to gain access.
Overflowing the buffer's memory is the specific exploit for a buffer overflow vulnerability, which applies to Machine 2, not Machine 1's SQL injection vulnerability.
Inserting malicious commands into the database is the direct method for exploiting an SQL injection vulnerability, specifically targeting Machine 1's web application and its backend database. This action is unrelated to buffer overflows and thus would not affect Machine 2.
Concept tested: SQL injection attack principle
Source: https://www.owasp.org/www-project-top-ten/2017/A1_2017-Injection
Topics
Community Discussion
No community discussion yet for this question.