Black-box testing is a method of software testing that examines the functionality of an application (e.g., what the software does) without peering into its internal structures or workings. Black-box testing is used to detect issues in SQL Injections and to detect XSS, injection vulnerabilities. Most commonly, SQL injection vulnerabilities are a result of using vulnerable programming during the Implementation/Development phase and will likely require code changes. Pen testers need to perform this testing during the development phase to find and fix the SQL injection vulnerability. What can a pen tester do to detect input sanitization issues?

Question

Accepted Answer

D. Send a SQL escape character (the '?' character) as the input data to catch instances where the user input is used as part of a SQL identifier without any input sanitization

Answer

A. Send single quotes as the input data to catch instances where the user input is not sanitized

Answer

B. Send double quotes as the input data to catch instances where the user input is not sanitized

Answer

C. Send long strings of junk data, just as you would send strings to detect buffer overruns

Black-box testing is a method of software testing that examines the functionality of an application (e.g., what the software does) without peering into its internal structures or workings. Black-box…

Question

Options

How the community answered

Community Discussion