An attacker attempted to compromise a web form by inserting the following input into the username field: admin)(|(password=*)) Which of the following types of attacks was attempted?

The correct answer is D. LDAP injection. The input 'admin)(|(password=))' uses LDAP filter syntax. The parentheses, pipe (|), and asterisk () are all LDAP query operators. The attacker is attempting to manipulate an LDAP query to bypass authentication by injecting a filter that could match any password ('password=*'…

Threats, vulnerabilities, and mitigations

Question

An attacker attempted to compromise a web form by inserting the following input into the username field:

admin)(|(password=*)) Which of the following types of attacks was attempted?

Options

ASQL injection
BCross-site scripting
CCommand injection
DLDAP injection

How the community answered

(31 responses)

A
16% (5)
B
10% (3)
C
3% (1)
D
71% (22)

Explanation

The input 'admin)(|(password=))' uses LDAP filter syntax. The parentheses, pipe (|), and asterisk () are all LDAP query operators. The attacker is attempting to manipulate an LDAP query to bypass authentication by injecting a filter that could match any password ('password=*' means any password). SQL injection (A) would use SQL operators like quotes, dashes, or UNION keywords. Cross-site scripting (B) injects client-side scripts like <script> tags. Command injection (C) injects OS-level commands. The LDAP-specific syntax makes this clearly an LDAP injection attack.

Topics

#LDAP injection#injection attacks#web application security#input validation

Community Discussion

No community discussion yet for this question.

Full SY0-301 Practice