SQL Injection CEH Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which of the following is a manual technique to detect a SQL injection vulnerability in a web application's login form?

   • AChecking the web server's HTTP response headers for SQL keywords.
   • BReviewing the application's source code for the use of parameterized queries.
   • CUsing a vulnerability scanner to automatically test all input fields.
   • DEntering a single quote (') in the username field and observing if the application returns a database error.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which SQL injection technique is commonly used to bypass a login form's authentication by making the WHERE clause always true?

   • APayload like ' OR '1'='1
   • BUnion-based SQL injection
   • CTime-based blind SQL injection
   • DBoolean-based blind SQL injection
   Reveal Solution Discussion Select an answer first
4. 33application · medium · select all that apply

   A penetration tester is evaluating a web application for SQL injection. The tester has identified a parameter that appears to be vulnerable. Which of the following are valid manual techniques to confirm the vulnerability? (Select all that apply.)

   • ASubmit a JavaScript alert payload like <script>alert(1)</script> and check if it executes.
   • BSubmit a boolean condition like ' AND 1=1-- and compare the response to ' AND 1=2--.
   • CUse sqlmap with the --batch flag to automatically detect the vulnerability.
   • DSubmit a time-based payload like ' OR SLEEP(5)-- and measure the response time.
   • ESubmit a single quote and observe for database error messages.
   Check answers Discussion Select an answer first
5. 34application · medium

   A penetration tester is attempting to bypass authentication on a web application. The login query is: SELECT * FROM users WHERE username = '$user' AND password = '$pass'. The tester wants to log in as the first user in the table without knowing the password. Which payload should the tester use in the username field?

   • A'; DROP TABLE users; --
   • B' AND 1=1 --
   • C' UNION SELECT * FROM users --
   • D' OR '1'='1' --
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   Which of the following is the most effective defense against SQL injection?

   • AUsing parameterized queries (prepared statements) for all database access.
   • BUsing a web application firewall (WAF) to block malicious requests.
   • CDisabling error messages on the web server.
   • DEncoding all user input with HTML entities before storing it in the database.
   Reveal Solution Discussion Select an answer first