QuestionQ9

VerifiedWeb application and API security with botnet mitigation

While reviewing FortiWeb logs, you observe a suspicious login request that did not authenticate. You suspect it could be part of an injection attack against the login form.

Which input pattern is an example of a common SQL injection attempt that might bypass authentication checks?

Explanation

A quote can terminate the expected username value, and a -- line comment can cause the database to ignore the subsequent password condition. This can alter a login query so authentication succeeds without validating the password. FortiWeb identifies SQL line comments as a SQL-injection type.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!