An attacker submits a request containing unexpected characters in an attempt to gain unauthorized access to information within the underlying systems. Which of the following best describes this…

Question

Options

• ASide loading
• BTarget of evaluation
• CResource reuse
• DSQL injection

• A
  5% (2)
• B
  2% (1)
• C
  2% (1)
• D
  91% (39)

Explanation

SQL injection matches perfectly: an attacker crafts input containing unexpected characters (like ' OR 1=1 --) to manipulate backend database queries and gain unauthorized access to data the application never intended to expose.

Why the distractors are wrong:

• A. Side loading refers to installing applications from unofficial sources, bypassing app store controls - unrelated to crafted input attacks.
• B. Target of evaluation (TOE) is a Common Criteria term for the system being security-evaluated, not an attack type at all.
• C. Resource reuse describes a threat where sensitive data left in memory or storage is accessed by another process - no malicious input crafting involved.

Memory tip: Think of SQL injection as "injecting poison" into a query - the attacker injects malicious characters into input fields to corrupt or hijack the database command. The key phrase in the question is "unexpected characters" + "underlying systems" (i.e., the database layer), which is the textbook signature of SQLi.

No community discussion yet for this question.