ECSA v10: EC-Council Certified Security Analyst v10Demo

Question

Arnold is attempting to access a database by injecting exploit query statements through a WHERE clause. He wants to use the WHERE clause to retrieve every entry from a specific table (for example, StudName).

Which query must Arnold write to retrieve the information?

A EXTRACT * FROM StudName WHERE roll_number = 1 order by 1000
B DUMP * FROM StudName WHERE roll_number = 1 AND 1=1ג€"
C SELECT * FROM StudName WHERE roll_number = " or '1' = '1'
D RETRIVE * FROM StudName WHERE roll_number = 1'#

Explanation

A tautological predicate such as '1' = '1' always evaluates to true. When injected into a WHERE condition with OR, it can make the condition match all rows in the table.

ECSA v10: EC-Council Certified Security Analyst v10Demo

AstroTutor

Notes

Readiness

QuestionQ48

Community Discussion