SQL Injection CEH Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   Which command-line tool is specifically designed to automate the detection and exploitation of SQL injection vulnerabilities?

   • Asqlmap
   • BHydra
   • CJohn the Ripper
   • DNikto
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   Which SQL injection technique is considered a subtype of blind SQL injection because it does not return data directly but relies on the application's response being true or false?

   • ABoolean-based blind SQL injection
   • BError-based SQL injection
   • CStacked queries SQL injection
   • DUnion-based SQL injection
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A security auditor is reviewing a web application that allows users to search for products. The auditor discovers that the application uses string concatenation to build SQL queries. Which of the following is the most likely impact of this vulnerability?

   • AAn attacker could execute arbitrary operating system commands on the web server.
   • BAn attacker could steal session cookies from other users by injecting JavaScript.
   • CAn attacker could extract sensitive data from the database, modify data, or bypass authentication.
   • DAn attacker could cause a denial of service by sending malformed requests that crash the web server.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A security analyst is testing a web application that does not display database errors or query results. The analyst submits a payload that causes a delay in the database response when the condition is true, and no delay when false. Which type of SQL injection is this, and what is the primary challenge associated with it?

   • AError-based SQL injection; it relies on error messages.
   • BBlind SQL injection (time-based); it is slow because each condition requires a separate request and a delay.
   • CIn-band SQL injection; it is fast because data is returned directly.
   • DOut-of-band SQL injection; it is efficient because it uses a separate channel.
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A security analyst is using sqlmap to test a web application that requires authentication. The analyst has valid credentials and wants to test a parameter that is only accessible after login. The application uses a session cookie for authentication. Which sqlmap option should be used to maintain the session?

   • A--cookie='PHPSESSID=abc123'
   • B--level=5 --risk=3
   • C--auth-type=Bearer --auth-token='token'
   • D--data='username=admin&password=pass'
   Reveal Solution Discussion Select an answer first