GCIH: GIAC Certified Incident HandlerDemo

Question

A web application receives the following input in a malicious request. What is the attacker trying to do?

select accountbalance from user where name = jake' OR 'z'='z';

A Download database records for a specific application user
B Combine two input requests into a single query
C Obtain database records for every application user
D Add a new user account to the application database

Explanation

A SQL-injection tautology such as OR 'z'='z' makes the filter condition true for every row, enabling retrieval of account-balance records for all application users.

GCIH: GIAC Certified Incident HandlerDemo

AstroTutor

Notes

Readiness

QuestionQ441

Community Discussion