Skip to content

lab6.md

Latest commit

 

History

History
97 lines (68 loc) · 3.33 KB

lab6.md

File metadata and controls

97 lines (68 loc) · 3.33 KB
Raw

Practice 6 - SQL Injection Attacks

Question 1:

Match the types of SQL injection attack to the descriptions.

Categories:

  • Inferential SQL Injection
    A
  • Out-of-Band SQL Injection
    B
  • In-Band SQL Injection
    C

Options:

  1. With this type of injection, the attacker obtains the data from the web application.
  2. With this type of injection, the attacker retrieves data by email, text, or instant message.
  3. With this type of injection, the attacker can reconstruct the information by sending specific statements and discerning the behavior of the application and database.

Question 2:

What is the purpose of performing database fingerprinting?

  • To verify the connectivity between a web application and the back-end database server
  • To understand the back-end database that the application uses
  • To gather performance statistics of the database server
  • To check the operating system in the database server

Question 3:

Match the SQL injection techniques to the descriptions.

Categories:

  • Out-of-Band Technique
    A
  • Union Operator
    B
  • Time Delay
    C
  • Boolean
    D
  • Error-Based Technique
    E

Options:

  1. This technique is typically used to obtain records from the database by using a different communications channel.
  2. This technique forces the database to generate an error to enhance and refine an attack (injection).
  3. This technique is used to verify whether certain conditions are true or false.
  4. This technique is typically used when an SQL injection vulnerability allows a UNION statement to combine two SELECT statements into a single injected query.
  5. This technique uses database commands to delay answers. An attacker can use this method to verify that injected queries are valid.

Question 4:

An attacker used the following SQL statement toward a database application:
SELECT * FROM IT_Admins WHERE customer_id=1; DELETE FROM IT_Admins

Which type of SQL injection attack was performed?

  • Out-of-Band
  • Stacked Queries
  • Boolean
  • Union Operator

Practice - Command Injection Vulnerabilities

A scan of the Pixel Paradise website has identified a hidden web page. Apparently, the IT staff uses it to troubleshoot connectivity to the Apache webserver that hosts the corporate website. The form allows the user to ping outside websites. You are curious about whether this input is protected from injection attacks, so you enter the following text into the form:

198.51.100.5; cat /etc/passwd

What vulnerability will this test for?

  • Command Injection
  • Code Execution
  • Code Injection
  • SQL Injection

Submission Instructions:

  1. Carefully complete the questions by selecting the appropriate answers or matching the categories correctly.
  2. Submit your responses via the designated platform or email them to your instructor by the end of the session.
  3. Justify your answers for the matching questions in a brief explanation to demonstrate your understanding of each concept.

Additional Resources:

  • Tutorials on SQL Injection Techniques
  • Videos on Preventing Command Injection Vulnerabilities
  • Case Studies of Real-World SQL Injection Attacks