When reviewing the security logs, the password shown for an administrative login event was ' OR ' '1'='1' --. This is an example of which of the following kinds of attack?

Question

Options

• ABrute Force Attack
• BStructured Query Language (SQL) Injection
• CCross-Site Scripting (XSS)
• DRainbow Table Attack

• B
  89% (24)
• C
  4% (1)
• D
  7% (2)

Explanation

SQL Injection Attack Explained

Option B is correct because ' OR '1'='1' -- is a classic SQL injection payload - it manipulates a login query by injecting SQL syntax that makes the WHERE clause always evaluate to true ('1'='1'), bypassing authentication entirely without needing a valid password.

Why the distractors are wrong:

• A (Brute Force): Brute force involves systematically trying many passwords until one works - it uses real credentials, not code manipulation
• C (XSS): Cross-Site Scripting injects malicious JavaScript/HTML into web pages to attack users' browsers, not database queries
• D (Rainbow Table): Rainbow table attacks use precomputed hash tables to crack stolen password hashes offline, not to manipulate live login forms

Memory Tip: Look for the SQL punctuation giveaway - single quotes ('), double dashes (-- for comments), and logical operators like OR are the fingerprints of SQL injection. If you see database syntax in a password field, think SQL injection. A helpful phrase: "Quotes and dashes = database crashes."

No community discussion yet for this question.