nerdexam
GIAC

GSLC · Question #413

Which of the following tools is an automated tool that is used to implement SQL injections and to retrieve data from Web server databases?

The correct answer is C. Absinthe. Absinthe is a specialized automated tool designed to perform blind SQL injection attacks and extract data from backend databases of web applications.

Security Architecture & Engineering

Question

Which of the following tools is an automated tool that is used to implement SQL injections and to retrieve data from Web server databases?

Options

  • AStick
  • BADMutate
  • CAbsinthe
  • DFragroute

How the community answered

(31 responses)
  • B
    3% (1)
  • C
    94% (29)
  • D
    3% (1)

Why each option

Absinthe is a specialized automated tool designed to perform blind SQL injection attacks and extract data from backend databases of web applications.

AStick

Stick is a tool used to generate and send network packets to test intrusion detection systems (IDS), not for SQL injection.

BADMutate

ADMutate is a tool designed to mutate shellcode and evade signature-based intrusion detection systems, unrelated to SQL injection.

CAbsintheCorrect

Absinthe is an automated blind SQL injection tool that systematically queries web application databases by inferring data one bit or character at a time through crafted HTTP requests. It automates the process of detecting injectable parameters and retrieving database contents without requiring direct output from the server. This makes it a well-known tool in the context of web application penetration testing and SQL injection exploitation.

DFragroute

Fragroute is a network packet fragmentation tool used to evade IDS by intercepting and rewriting egress traffic, not a SQL injection tool.

Concept tested: Automated SQL injection tools and web exploitation

Source: https://owasp.org/www-community/attacks/SQL_Injection

Topics

#SQL injection#automated attack tools#web application security#Absinthe

Community Discussion

No community discussion yet for this question.

Full GSLC Practice