SY0-301 · Question #357
When an order was submitted via the corporate website, an administrator noted special characters (e.g., ";--" and "or 1=1 --") were input instead of the expected letters and numbers. Which of the…
The correct answer is D. The user is sending malicious SQL injection strings in order to extract sensitive company or customer. The characters ';--' and 'OR 1=1 --' are classic SQL injection payloads designed to terminate legitimate queries and inject malicious logic. This indicates the user is attempting to manipulate the back-end database.
Question
When an order was submitted via the corporate website, an administrator noted special characters (e.g., ";--" and "or 1=1 --") were input instead of the expected letters and numbers. Which of the following is the MOST likely reason for the unusual results?
Options
- AThe user is attempting to highjack the web server session using an open-source browser.
- BThe user has been compromised by a cross-site scripting attack (XSS) and is part of a botnet performing
- CThe user is attempting to fuzz the web server by entering foreign language characters which are
- DThe user is sending malicious SQL injection strings in order to extract sensitive company or customer
How the community answered
(31 responses)- A3% (1)
- B3% (1)
- C6% (2)
- D87% (27)
Why each option
The characters ';--' and 'OR 1=1 --' are classic SQL injection payloads designed to terminate legitimate queries and inject malicious logic. This indicates the user is attempting to manipulate the back-end database.
Session hijacking involves stealing or forging session tokens, not submitting special characters into form fields as part of an order.
XSS botnet activity would involve injected JavaScript executing in a victim browser, not SQL metacharacters submitted through a form.
Fuzzing with foreign language characters describes internationalization or encoding testing; the specific patterns ';--' and 'OR 1=1 --' are not foreign language characters but are well-known SQL metacharacter sequences.
SQL injection attacks use metacharacters such as single quotes, semicolons, and comment sequences ('--') to break out of the intended SQL statement context and inject arbitrary SQL logic. 'OR 1=1 --' causes a WHERE clause to always evaluate as true, potentially returning all rows in a table, and ';--' terminates one statement and comments out the rest, which are hallmark techniques for data extraction or authentication bypass.
Concept tested: SQL injection attack recognition and identification
Source: https://owasp.org/www-community/attacks/SQL_Injection
Topics
Community Discussion
No community discussion yet for this question.