nerdexam
GIAC

GCIH · Question #100

You work as a Network Penetration tester in the Secure Inc. Your company takes the projects to test the security of various companies. Recently, Secure Inc. has assigned you a project to test the…

The correct answer is D. Deletes the entire members table. The injected SQL uses a stacked query to append a DROP TABLE command, which permanently removes the entire members table and all its rows from the database.

Web Application Attacks & Post-Exploitation

Question

You work as a Network Penetration tester in the Secure Inc. Your company takes the projects to test the security of various companies. Recently, Secure Inc. has assigned you a project to test the security of a Web site. You go to the Web site login page and you run the following SQL query:

SELECT email, passwd, login_id, full_name FROM members WHERE email = '[email protected]'; DROP TABLE members; --' What task will the above SQL query perform?

Options

  • ADeletes the database in which members table resides.
  • BDeletes the rows of members table where email id is '[email protected]' given.
  • CPerforms the XSS attacks.
  • DDeletes the entire members table.

How the community answered

(63 responses)
  • A
    13% (8)
  • B
    6% (4)
  • C
    3% (2)
  • D
    78% (49)

Why each option

The injected SQL uses a stacked query to append a DROP TABLE command, which permanently removes the entire members table and all its rows from the database.

ADeletes the database in which members table resides.

DROP TABLE targets only the specified table, not the entire database - deleting the database would require a DROP DATABASE command.

BDeletes the rows of members table where email id is '[email protected]' given.

The query does not use a DELETE statement with a WHERE clause; DROP TABLE removes the full table unconditionally, not just rows matching the email address.

CPerforms the XSS attacks.

XSS (Cross-Site Scripting) is a client-side injection that injects malicious scripts into web page output; this query is a server-side SQL injection with no XSS component.

DDeletes the entire members table.Correct

The payload `; DROP TABLE members; --` terminates the original SELECT statement and executes a DDL DROP TABLE command, which deletes the entire members table - both its structure and all contained data. The double-dash comment sequence `--` nullifies any trailing SQL characters that would otherwise cause a syntax error, ensuring the injection executes cleanly.

Concept tested: SQL injection stacked query with DROP TABLE statement

Source: https://owasp.org/www-community/attacks/SQL_Injection

Topics

#SQL injection#DROP TABLE#database attacks#web application security

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GCIH Practice