nerdexam
GIAC

GPEN · Question #334

Which of the following tools is an automated tool that is used to implement SQL injections and to retrieve data from Web server databases?

The correct answer is B. Absinthe. Absinthe is an automated blind SQL injection tool designed to extract data from backend web server databases without relying on visible error messages.

Web Application Penetration Testing

Question

Which of the following tools is an automated tool that is used to implement SQL injections and to retrieve data from Web server databases?

Options

  • AFragroute
  • BAbsinthe
  • CStick
  • DADMutate

How the community answered

(34 responses)
  • A
    6% (2)
  • B
    76% (26)
  • C
    15% (5)
  • D
    3% (1)

Why each option

Absinthe is an automated blind SQL injection tool designed to extract data from backend web server databases without relying on visible error messages.

AFragroute

Fragroute is a packet fragmentation and mangling tool used to evade intrusion detection systems at the network layer, not for SQL injection.

BAbsintheCorrect

Absinthe automates blind SQL injection attacks by systematically crafting boolean-based queries to infer database content one bit at a time, even when the application does not return visible error details. It is purpose-built to retrieve structured data from web application databases, directly matching the description of an automated SQL injection and data retrieval tool. Its automation removes the need for manual query construction during exploitation.

CStick

Stick is an IDS stress-testing tool that generates attack signatures to evaluate sensor performance, not a SQL injection utility.

DADMutate

ADMutate is a shellcode polymorphism tool that mutates exploit payloads to bypass IDS signature detection, unrelated to SQL injection.

Concept tested: Automated blind SQL injection tools and database extraction

Source: https://owasp.org/www-community/attacks/SQL_Injection

Topics

#SQL injection#Absinthe#automated exploitation#web database

Community Discussion

No community discussion yet for this question.

Full GPEN Practice