ECSA v10: EC-Council Certified Security Analyst v10

By ECCouncil · Question Mode

QuestionQ93

VerifiedWeb Application Penetration Testing Methodology

Stanley, a penetration tester, needs to conduct various tests to identify SQL injection vulnerabilities. He must create a list of all input fields whose values might be used to construct a SQL query. This includes hidden fields in POST requests, which must then be tested separately by attempting to disrupt the query and trigger an error.

Which of the following tests examines the application’s source code in a non-runtime environment to identify SQL injection vulnerabilities?

Explanation

Static testing, also called static application security testing (SAST) or source-code analysis, examines non-running source code for insecure data flows and vulnerability patterns, including SQL injection risks. Dynamic testing instead evaluates a running application through executed requests and payloads.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!