Which of the following types of application attacks would be used to specifically gain unauthorized information from databases that did not have any input validation implemented?

The correct answer is A. SQL injection. SQL injection (SQLi) exploits the lack of input validation to insert or 'inject' malicious SQL code into queries sent to a database. Attackers can manipulate queries to bypass authentication, extract sensitive records, modify data, or even execute commands. The question…

Threats, vulnerabilities, and mitigations

Question

Options

ASQL injection
BSession hijacking and XML injection
CCookies and attachments
DBuffer overflow and XSS

How the community answered

(17 responses)

A
88% (15)
B
6% (1)
D
6% (1)

Explanation

SQL injection (SQLi) exploits the lack of input validation to insert or 'inject' malicious SQL code into queries sent to a database. Attackers can manipulate queries to bypass authentication, extract sensitive records, modify data, or even execute commands. The question specifically says 'databases' and 'no input validation' - both are the defining conditions for SQL injection. Session hijacking/XML injection (B) target sessions and XML parsers respectively. Cookies and attachments (C) are not attack types per se. Buffer overflow and XSS (D) target memory and web page rendering, not databases directly.

Topics

#SQL injection#input validation#database attacks#web application security

Community Discussion

No community discussion yet for this question.

Full SY0-301 Practice