nerdexam
GIAC

GPEN · Question #78

Which of the following Web attacks is performed by manipulating codes of programming languages such as SQL, Perl, Java present in the Web pages?

The correct answer is D. Code injection attack. A code injection attack occurs when an attacker injects and executes malicious code written in a language the application interprets, such as SQL, Perl, or Java, directly manipulating application logic.

Web Application Penetration Testing

Question

Which of the following Web attacks is performed by manipulating codes of programming languages such as SQL, Perl, Java present in the Web pages?

Options

  • ACommand injection attack
  • BCross-Site Scripting attack
  • CCross-Site Request Forgery
  • DCode injection attack

How the community answered

(18 responses)
  • A
    11% (2)
  • B
    6% (1)
  • C
    6% (1)
  • D
    78% (14)

Why each option

A code injection attack occurs when an attacker injects and executes malicious code written in a language the application interprets, such as SQL, Perl, or Java, directly manipulating application logic.

ACommand injection attack

Command injection targets the underlying operating system shell by injecting OS-level commands (e.g., bash, cmd), not programming language code embedded in web page logic.

BCross-Site Scripting attack

Cross-Site Scripting (XSS) injects client-side scripts (typically JavaScript) into pages viewed by other users to steal session tokens or perform actions on their behalf, not to manipulate server-side programming language code.

CCross-Site Request Forgery

Cross-Site Request Forgery (CSRF) tricks an authenticated user's browser into sending forged requests to a trusted site, exploiting session trust rather than injecting or manipulating any programming language code.

DCode injection attackCorrect

Code injection specifically involves inserting malicious code in a programming or scripting language (SQL, Perl, Java, PHP, etc.) that the server-side application interprets and executes, allowing the attacker to alter application behavior, access data, or run arbitrary logic within the application's execution context.

Concept tested: Code injection attack via server-side language manipulation

Source: https://owasp.org/www-community/attacks/Code_Injection

Topics

#code injection#web attacks#injection flaws#server-side

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GPEN Practice