EC-Council
412-79V9 · Question #32
Most commonly, SQL injection vulnerabilities are a result of coding vulnerabilities during the Implementation/Development phase and will likely require code changes. Pen testers need to perform this…
The correct answer is D. Use a right square bracket (the "]" character) as the input data to catch instances where the user input is used as part of a SQL identifier without any input sanitization. See the full explanation below for the reasoning.
Question
Most commonly, SQL injection vulnerabilities are a result of coding vulnerabilities during the Implementation/Development phase and will likely require code changes. Pen testers need to perform this testing during the development phase to find and fix the SQL injection vulnerability. What can a pen tester do to detect input sanitization issues?
Options
- ASend single quotes as the input data to catch instances where the user input is not sanitized
- BSend double quotes as the input data to catch instances where the user input is not sanitized
- CSend long strings of junk data, just as you would send strings to detect buffer overrun
- DUse a right square bracket (the "]" character) as the input data to catch instances where the user input is used as part of a SQL identifier without any input sanitization
How the community answered
(50 responses)- A4% (2)
- B8% (4)
- C14% (7)
- D74% (37)
Community Discussion
No community discussion yet for this question.