SQL Injection CEH Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   When using sqlmap to test a URL for SQL injection, which option specifies the target URL?

   • A--url
   • B--host
   • C--target
   • D--request
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A penetration tester is assessing a web application that uses a login form. The tester submits ' OR '1'='1' -- in the username field and gains access to the first account in the database. The application returns a generic error page when invalid credentials are submitted. Which type of SQL injection is the tester most likely exploiting, and what is the primary reason the attack succeeds?

   • ASecond-order SQL injection, because the payload is stored and executed later.
   • BBlind SQL injection, because the application does not return database error messages.
   • CIn-band SQL injection, because the application directly concatenates user input into the SQL query without parameterization.
   • DOut-of-band SQL injection, because the attack uses a comment to alter the query structure.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A security consultant is reviewing a web application that uses an ORM (Object-Relational Mapping) framework. The consultant finds that the ORM allows raw SQL queries for complex reporting. The reporting feature accepts user input for sorting and filtering. Which of the following is the most secure way to implement this feature?

   • AUse a stored procedure that takes the sort column and direction as parameters.
   • BUse a WAF to block any request containing SQL keywords in the sorting parameter.
   • CUse raw SQL with string concatenation for the entire query, but sanitize input with a custom function.
   • DUse the ORM's query builder with parameter binding for all user-supplied values, and whitelist sortable columns.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A web application developer is reviewing code that handles user input for a search feature. The code currently concatenates user input directly into a SQL query. The developer wants to refactor the code to prevent SQL injection while minimizing changes to the application logic. Which approach is the most secure and least disruptive?

   • AImplement a Web Application Firewall (WAF) rule to block SQL injection patterns.
   • BUse a stored procedure that builds the query dynamically using EXEC.
   • CReplace the concatenated query with a parameterized query using prepared statements.
   • DAdd a function that escapes all single quotes in the user input before concatenation.
   Reveal Solution Discussion Select an answer first
6. 15application · medium · select all that apply

   A security analyst is using sqlmap to test a web application. The analyst wants to avoid detection by the application's logging system. Which sqlmap options can help reduce the number of requests sent? (Select all that apply.)

   • A--delay=2
   • B--technique=BEU
   • C--level=1 --risk=1
   • D--batch
   • E--threads=10
   Check answers Discussion Select an answer first