ECSA v10: EC-Council Certified Security Analyst v10Demo

By ECCouncil · Question Mode

QuestionQ92

Web Application Penetration Testing Methodology

Sam is auditing a web application for SQL injection flaws. While testing, Sam finds that the application is vulnerable to SQL injection. He begins fuzzing the application's search field with UNION-based SQL queries, but realizes that the underlying WAF blocks the requests. To bypass this, Sam tries the following query:

UNION/**/SELECT/**/'/**/OR/**/1/**/=/**/1

Which evasion technique is Sam using?

  • A Sam is using char encoding to bypass WAF
  • B Sam is using obfuscated code to bypass WAF
  • C Sam is using inline comments to bypass WAF
  • D Sam is manipulating white spaces to bypass WAF
Explanation

/**/ is SQL block-comment syntax. Inserting inline comments between SQL keywords can preserve query parsing while evading WAF signatures that expect conventional keyword spacing or contiguous patterns.

Community Discussion

No comments yet. Be the first to start the discussion!