ECSA v10: EC-Council Certified Security Analyst v10

By ECCouncil · Question Mode

QuestionQ126

VerifiedWeb Application Penetration Testing Methodology

David is a junior consultant performing a penetration-testing assignment. His supervisor instructed him to test a web application for SQL injection and advised that the application is known to be vulnerable to the admin' OR ' injection. When David attempted that string, the WAF returned an error stating that the input is not permitted.

Which of the following strings could David use in place of that string to bypass the WAF filtering?

Explanation

A SQL authentication-bypass payload can terminate the application’s quoted input, make the predicate evaluate as true, and use a trailing comment to prevent the rest of the original query from changing that result. This is the alternative that preserves the intended bypass while changing the payload structure from the blocked signature.

Community Discussion

No comments yet. Be the first to start the discussion!