ECSA v10: EC-Council Certified Security Analyst v10

By ECCouncil · Question Mode

QuestionQ81

VerifiedWeb Application Penetration Testing Methodology

George, a reputed ethical hacker and penetration-testing consultant, was hired by FNB Services, a startup financial-services company, to audit the security of its web applications. During the investigation, George discovered that the company website is vulnerable to blind SQL-injection attacks. George entered a custom SQL query into a form on the vulnerable page, resulting in a back-end SQL query similar to the following:

http://fnb.com/forms/?id=1+AND+555=if(ord(mid((select+pass from+users+limit+0,1),1,2))= 97,555,777)

What is George attempting to achieve with this custom SQL query?

Explanation

LIMIT 0,1 retrieves the first row from the selected pass values. MID(...,1,2) starts at the first character, and ORD() obtains the character code of that substring’s first character. Testing whether it equals 97 allows blind inference of the first character of the first selected entry.

Community Discussion

No comments yet. Be the first to start the discussion!