How does an attacker try to trick a database into revealing information that can help with an attack?

Question

Options

• ASending poison cookies containing crafted SQL statements to the database
• BSending specially crafted SQL packets to the database in order to take the database offline
• CSending large numbers of SYN packets to the database server and analyzing the responses
• DSending the database specially crafted queries containing quote characters

• A
  5% (2)
• B
  2% (1)
• C
  2% (1)
• D
  91% (40)

Explanation

This question describes SQL injection reconnaissance. Attackers send specially crafted queries containing quote characters (especially the single quote ') to probe how the database responds. When a single quote is injected into a query parameter, it can break the SQL syntax and cause the database to return error messages that reveal the database type, version, table names, or query structure - all valuable information for planning a deeper attack. Option A is incorrect because SQL statements are sent in HTTP parameters, not cookies in this context (though cookie injection exists, it's less direct). Option B describes a denial-of-service approach, not information gathering. Option C describes a SYN flood, which is a network-layer DoS attack unrelated to database reconnaissance.

No community discussion yet for this question.