GPEN · Question #10
Which of the following tools can be used to perform brute force attack on a remote database? Each correct answer represents a complete solution. Choose all that apply.
The correct answer is A. FindSA B. SQLDict D. SQLBF. FindSA, SQLDict, and SQLBF are tools designed specifically to brute force or dictionary-attack SQL Server credentials; nmap is a network scanner without native database brute force capability.
Question
Which of the following tools can be used to perform brute force attack on a remote database? Each correct answer represents a complete solution. Choose all that apply.
Options
- AFindSA
- BSQLDict
- Cnmap
- DSQLBF
How the community answered
(47 responses)- A70% (33)
- C30% (14)
Why each option
FindSA, SQLDict, and SQLBF are tools designed specifically to brute force or dictionary-attack SQL Server credentials; nmap is a network scanner without native database brute force capability.
FindSA is a tool that locates SQL Server instances on a network and can perform brute force authentication attacks against discovered SQL Server logins.
SQLDict is a dictionary-based attack tool that systematically attempts credential combinations against SQL Server database accounts to gain unauthorized access.
nmap is a network discovery and port scanning tool; while it has NSE scripting support for some checks, it is not a brute force credential attack tool targeting remote databases.
SQLBF is a dedicated SQL Server brute force utility that iterates through credential combinations to crack SQL Server authentication.
Concept tested: Database brute force attack tools for SQL Server
Source: https://owasp.org/www-community/attacks/Brute_force_attack
Topics
Community Discussion
No community discussion yet for this question.