GCIH: GIAC Certified Incident HandlerDemo

By GIAC · Question Mode

QuestionQ466

Web Application Injection Attacks

How might an attacker attempt to deceive a database into disclosing information that could assist an attack?

  • A Sending poison cookies containing crafted SQL statements to the database
  • B Sending specially crafted SQL packets to the database in order to take the database offline
  • C Sending large numbers of SYN packets to the database server and analyzing the responses
  • D Sending the database specially crafted queries containing quote characters
Explanation

SQL injection uses specially crafted input containing quotation marks or other SQL syntax to change the intended query. This can cause a database to return unauthorized data or detailed error information that helps an attacker.

Community Discussion

No comments yet. Be the first to start the discussion!