nerdexam
GAQM

CPEH-001 · Question #824

Suppose that you test an application for the SQL injection vulnerability. You know that the backend database is based on Microsoft SQL Server. In the login/password form, you enter the following…

The correct answer is D. select * from Users where UserName = 'attack' or 1=1 --' and UserPassword = '123456'. See the full explanation below for the reasoning.

Question

Suppose that you test an application for the SQL injection vulnerability. You know that the backend database is based on Microsoft SQL Server. In the login/password form, you enter the following credentials:

Username: attack' or 1=1 -- Password: 123456 Based on the above credentials, which of the following SQL commands are you expecting to be executed by the server, if there is indeed an SQL injection vulnerability?

Options

  • Aselect * from Users where UserName = 'attack'' or 1=1 -- and UserPassword = '123456'
  • Bselect * from Users where UserName = 'attack' or 1=1 -- and UserPassword = '123456'
  • Cselect * from Users where UserName = 'attack or 1=1 -- and UserPassword = '123456'
  • Dselect * from Users where UserName = 'attack' or 1=1 --' and UserPassword = '123456'

How the community answered

(26 responses)
  • A
    8% (2)
  • B
    15% (4)
  • C
    4% (1)
  • D
    73% (19)

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CPEH-001 Practice