ECSA v10: EC-Council Certified Security Analyst v10

By ECCouncil · Question Mode

QuestionQ92

VerifiedWeb Application Penetration Testing Methodology

Sam is auditing a web application for SQL injection flaws. While testing, Sam finds that the application is vulnerable to SQL injection. He begins fuzzing the application's search field with UNION-based SQL queries, but realizes that the underlying WAF blocks the requests. To bypass this, Sam tries the following query:

UNION/**/SELECT/**/'/**/OR/**/1/**/=/**/1

Which evasion technique is Sam using?

Explanation

/**/ is SQL block-comment syntax. Inserting inline comments between SQL keywords can preserve query parsing while evading WAF signatures that expect conventional keyword spacing or contiguous patterns.

Community Discussion

No comments yet. Be the first to start the discussion!