A security tester is testing a website and performs the following manual query: The following response is received in the payload: "ORA-000001: SQL command not properly ended" Which of the following…

The correct answer is A. Fingerprinting. This is an example of Fingerprinting. The response to the code entered includes "ORA- 000001" which tells the attacker that the database software being used is Oracle. Fingerprinting can be used as a means of ascertaining the operating system of a remote computer on a network…

Enterprise Security Operations

Question

A security tester is testing a website and performs the following manual query:

The following response is received in the payload:

"ORA-000001: SQL command not properly ended" Which of the following is the response an example of?

Options

AFingerprinting
BCross-site scripting
CSQL injection
DPrivilege escalation

How the community answered

(28 responses)

A
93% (26)
C
4% (1)
D
4% (1)

Explanation

This is an example of Fingerprinting. The response to the code entered includes "ORA- 000001" which tells the attacker that the database software being used is Oracle. Fingerprinting can be used as a means of ascertaining the operating system of a remote computer on a network. Fingerprinting is more generally used to detect specific versions of applications or protocols that are run on network servers. Fingerprinting can be accomplished "passively" by sniffing network packets passing between hosts, or it can be accomplished "actively" by transmitting specially created packets to the target machine and analyzing the response.

Topics

#fingerprinting#information disclosure#web application security#SQL error messages

Community Discussion

No community discussion yet for this question.

Full CAS-003 Practice