A penetration tester is looking for vulnerabilities within a company's web application that are in scope. The penetration tester discovers a login page and enters the following string in a field…

The correct answer is C. Stacked queries. The penetration tester is using a type of injection attack called stacked queries, which means appending multiple SQL statements separated by semicolons in a single input field. This can allow the penetration tester to execute arbitrary SQL commands on the database server, such…

Attacks and Exploits

Question

A penetration tester is looking for vulnerabilities within a company's web application that are in scope. The penetration tester discovers a login page and enters the following string in a field:

1;SELECT Username, Password FROM Users; Which of the following injection attacks is the penetration tester using?

Options

ABlind SQL
BBoolean SQL
CStacked queries
DError-based

How the community answered

(43 responses)

A
5% (2)
B
16% (7)
C
72% (31)
D
7% (3)

Explanation

The penetration tester is using a type of injection attack called stacked queries, which means appending multiple SQL statements separated by semicolons in a single input field. This can allow the penetration tester to execute arbitrary SQL commands on the database server, such as selecting username and password from users table.

Topics

#SQL Injection#Stacked Queries#Web Application Exploits#Vulnerability Exploitation

Community Discussion

No community discussion yet for this question.

Full PT0-002 Practice