ECSA v10: EC-Council Certified Security Analyst v10Demo

By ECCouncil · Question Mode

QuestionQ117

Database Penetration Testing Methodology

Stuart is a database penetration tester for Regional Server Technologies. The company asked him to identify vulnerabilities in its SQL database. Stuart wanted to conduct SQL penetration testing by passing SQL commands through a web application for execution, and he succeeded with a command that used a wildcard attribute indicator.

Which of the following strings is a wildcard attribute indicator?

  • A ?Param1=foo&Param2=bar
  • B %
  • C @variable
  • D @@variable
Explanation

In SQL pattern matching, % is a wildcard character that represents any sequence of zero or more characters, commonly used with the LIKE predicate.

Community Discussion

No comments yet. Be the first to start the discussion!