nerdexam
GIAC

GPEN · Question #476

Why is it important to have a cheat sheet reference of database system tables when performing SQL Injection?

The correct answer is D. These tables contain metadata that can be queried to gain additional helpful information. Database system tables such as INFORMATION_SCHEMA store metadata that SQL injection attackers query to enumerate schema structure and plan further exploitation.

Web Application Penetration Testing

Question

Why is it important to have a cheat sheet reference of database system tables when performing SQL Injection?

Options

  • AThis is where sites typically store sensitive information such as credit card numbers.
  • BThese tables contain a list of allowed database applications
  • CThe information in these tables will reveal details about the web application's code.
  • DThese tables contain metadata that can be queried to gain additional helpful information.

How the community answered

(36 responses)
  • A
    3% (1)
  • B
    11% (4)
  • C
    6% (2)
  • D
    81% (29)

Why each option

Database system tables such as INFORMATION_SCHEMA store metadata that SQL injection attackers query to enumerate schema structure and plan further exploitation.

AThis is where sites typically store sensitive information such as credit card numbers.

Sensitive application data such as credit card numbers resides in application-defined tables, not in database system or catalog tables.

BThese tables contain a list of allowed database applications

System tables do not maintain lists of allowed database applications; access controls are managed by the database engine's permission system, not stored there.

CThe information in these tables will reveal details about the web application's code.

System tables expose database-level structural metadata, not the server-side source code of the web application.

DThese tables contain metadata that can be queried to gain additional helpful information.Correct

System tables like INFORMATION_SCHEMA.TABLES and INFORMATION_SCHEMA.COLUMNS contain metadata including table names, column names, data types, and user privileges. Querying these tables via SQL injection allows an attacker to enumerate the database schema without prior knowledge, enabling targeted extraction of sensitive data. This metadata-based enumeration is a foundational technique in manual SQL injection exploitation.

Concept tested: SQL injection enumeration using database system catalog tables

Source: https://owasp.org/www-community/attacks/SQL_Injection

Topics

#SQL injection#database enumeration#system tables#metadata

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GPEN Practice