Web Application Attacks and SQL Injection ECSS Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A development team is fixing a SQL injection vulnerability in a login form. The application is written in Java and uses JDBC. Which of the following code changes is the most effective way to prevent SQL injection while maintaining functionality?

   • AUse a stored procedure that dynamically builds the query using EXEC.
   • BEscape single quotes in the username input before concatenating it into the query.
   • CUse PreparedStatement with parameterized queries for the login query.
   • DAdd a JavaScript function to the login page that blocks special characters in the username field.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   In a typical three-tier web application, which component is responsible for processing business logic and generating dynamic responses?

   • AApplication server
   • BClient-side browser
   • CWeb server
   • DDatabase server
   Reveal Solution Discussion Select an answer first
4. 13application · easy

   A penetration tester is beginning a web application assessment for a client. The client has provided the application's source code and a list of known technologies. According to a structured penetration testing methodology, which phase should the tester perform first?

   • AExploitation and gaining access
   • BReporting and remediation recommendations
   • CVulnerability scanning and analysis
   • DReconnaissance and information gathering
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A penetration tester is exploiting a SQL injection vulnerability in a login form. The original query is: SELECT * FROM users WHERE username = 'admin' AND password = 'anything'. The tester wants to bypass authentication without knowing the password. Which payload should the tester use in the username field?

   • Aadmin' AND '1'='1
   • Badmin' --
   • Cadmin' OR '1'='1
   • D' OR 1=1 --
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A penetration tester is exploiting a SQL injection vulnerability in a web application. The tester wants to enumerate the database schema to find table names. Which SQL statement would the tester most likely use?

   • ASELECT table_name FROM information_schema.tables
   • BSELECT name FROM sys.databases
   • CSELECT @@version
   • DSELECT * FROM users
   Reveal Solution Discussion Select an answer first