PT0-001 · Question #95
A recently concluded penetration test revealed that a legacy web application is vulnerable lo SQL injection Research indicates that completely remediating the vulnerability would require an…
The correct answer is D. Use a whitelist approach for SQL statements. E. Use a blacklist approach for SQL statements. Given this scenario, the client will want to use a blacklist and whitelist validation for the SQL statements. SQL injection is a common attack route that uses malicious SQL code for backend database manipulation to access information that was not intended to be displayed. SQL…
Question
A recently concluded penetration test revealed that a legacy web application is vulnerable lo SQL injection Research indicates that completely remediating the vulnerability would require an architectural change, and the stakeholders are not m a position to risk the availability of the application Under such circumstances, which of the following controls are low-effort, short-term solutions to minimize the SQL injection risk? (Select TWO).
Options
- AIdentify and eliminate inline SQL statements from the code.
- BIdentify and eliminate dynamic SQL from stored procedures.
- CIdentify and sanitize all user inputs.
- DUse a whitelist approach for SQL statements.
- EUse a blacklist approach for SQL statements.
- FIdentify the source of malicious input and block the IP address.
How the community answered
(66 responses)- A2% (1)
- B5% (3)
- C9% (6)
- D82% (54)
- F3% (2)
Explanation
Given this scenario, the client will want to use a blacklist and whitelist validation for the SQL statements. SQL injection is a common attack route that uses malicious SQL code for backend database manipulation to access information that was not intended to be displayed. SQL injections are one of the most common web hacking techniques. Blacklist validation tests the external input against a set of known malicious inputs. Whitelist validation tests an external input against a set of known, approved input. With whitelist input validation, the application knows exactly what is wanted and rejects other input.
Topics
Community Discussion
No community discussion yet for this question.