John works as a professional Ethical Hacker. He has been assigned a project to test the security and successfully logs in to the user page of the Web site. The we-are-secure login page is vulnerable…

A dictionary attack attempts to guess valid passwords by trying entries from a wordlist against known usernames - it does not manipulate query logic and relies on weak or common passwords existing.

SQL injection exploits improper input validation on login forms by inserting SQL syntax such as ' OR '1'='1 into the username or password field, causing the database query to evaluate as true and grant access without legitimate credentials. The vulnerability exists because user-supplied input is concatenated directly into SQL statements instead of being parameterized or sanitized. This is the standard technique an ethical hacker would use to bypass web authentication at the application layer.

A replay attack captures a legitimate authentication token or session packet and retransmits it to impersonate the user, requiring prior interception of valid session data rather than exploiting input handling.

A Land attack is a denial-of-service technique that sends TCP SYN packets with identical source and destination IP addresses to crash the target, and has no relevance to web application login bypass.